ZyWALL USG 1000 Unified Security Gateway User’s Guide Version 2.00 10/2007 Edition 1 DEFAULT LOGIN LAN Port P1 IP Address http://192.168.1.1 User Name admin Password 1234 www.zyxel.
About This User's Guide About This User's Guide This manual is designed to guide you through the configuration of your ZyWALL for its various applications. Generally, it is organized as follows.
About This User's Guide " It is recommended you use the web configurator to configure the ZyWALL. • Web Configurator Online Help Click the help icon in any screen for help in configuring that screen and supplementary information. • Supporting Disk Refer to the included CD for support documents. • ZyXEL Web Site Please refer to www.zyxel.com for additional support documentation and product certifications. User Guide Feedback Help us help you.
Document Conventions Document Conventions Warnings and Notes These are how warnings and notes are shown in this User’s Guide. 1 " Warnings tell you about things that could harm you or your device. Notes tell you other important information (for example, other things you may need to configure or helpful tips) or recommendations. Syntax Conventions • The ZyWALL USG1000 may be referred to as the “ZyWALL”, the “device”, the “system” or the “product” in this User’s Guide.
Document Conventions Icons Used in Figures Figures in this User’s Guide may use the following generic icons. The ZyWALL icon is not an exact representation of your device.
Safety Warnings Safety Warnings 1 For your safety, be sure to read and follow all warning notices and instructions. • Do NOT use this product near water, for example, in a wet basement or near a swimming pool. • Do NOT expose your device to dampness, dust or corrosive liquids. • Do NOT store things on the device. • Do NOT install, use, or service this device during a thunderstorm. There is a remote risk of electric shock from lightning. • Connect ONLY suitable accessories to the device.
Safety Warnings 8 ZyWALL USG 1000 User’s Guide
Contents Overview Contents Overview Introduction ............................................................................................................................ 51 Introducing the ZyWALL ............................................................................................................ 53 Features and Applications ......................................................................................................... 57 Web Configurator ...............................................
Contents Overview Content Filter Screens ............................................................................................................. 463 Content Filter Reports ............................................................................................................. 483 Device HA & Objects ........................................................................................................... 491 Device HA .............................................................................
Table of Contents Table of Contents About This User's Guide .......................................................................................................... 3 Document Conventions............................................................................................................ 5 Safety Warnings........................................................................................................................ 7 Contents Overview .......................................................
Table of Contents 3.1 Web Configurator Requirements ......................................................................................... 65 3.2 Web Configurator Access .................................................................................................... 65 3.3 Web Configurator Main Screen ........................................................................................... 67 3.3.1 Title Bar ...........................................................................................
Table of Contents 5.2 Terminology in the ZyWALL ................................................................................................112 5.3 Physical Ports, Interfaces, and Zones ................................................................................112 5.3.1 Network Topology Example .......................................................................................113 5.4 Feature Configuration Overview .................................................................................
Table of Contents 6.2.2 Set up the VPN Gateway ......................................................................................... 132 6.2.3 Set up the VPN Connection ..................................................................................... 133 6.2.4 Set up the Policy Route for the VPN Tunnel ............................................................ 134 6.2.5 Set up the Zone for the VPN Tunnel ........................................................................ 135 6.3 Device HA ...
Table of Contents 8.1 myZyXEL.com Overview ................................................................................................... 165 8.1.1 Subscription Services Available on the ZyWALL ..................................................... 165 8.2 Registration ....................................................................................................................... 166 8.3 Service ......................................................................................................
Table of Contents 10.6.1 PPPoE/PPTP Overview ......................................................................................... 210 10.6.2 PPPoE/PPTP Interfaces Overview .........................................................................211 10.6.3 PPPoE/PPTP Interface Summary .......................................................................... 212 10.6.4 PPPoE/PPTP Interface Add/Edit ........................................................................... 213 10.7 Auxiliary Interface .
Table of Contents 13.3 OSPF Overview .............................................................................................................. 237 13.3.1 OSPF Areas ........................................................................................................... 238 13.3.2 OSPF Routers ........................................................................................................ 239 13.3.3 Virtual Links ................................................................................
Table of Contents 18.1 ALG Introduction .............................................................................................................. 265 18.1.1 Application Layer Gateway (ALG) and NAT ........................................................... 265 18.1.2 ALG and Trunks ..................................................................................................... 265 18.1.3 FTP ...........................................................................................................
Table of Contents 20.4.2 Additional Topics for IKE SA .................................................................................. 310 20.4.3 VPN Gateway Summary ........................................................................................ 312 20.4.4 VPN Gateway Add/Edit ......................................................................................... 313 20.5 VPN Concentrator ...........................................................................................................
Table of Contents 24.3.1 Downloading a File ................................................................................................. 341 24.3.2 Saving a File .......................................................................................................... 341 24.4 Creating a New Folder ..................................................................................................... 342 24.5 Renaming a File or Folder ......................................................................
Table of Contents 27.5.1 Setting the Interface’s Bandwidth ........................................................................... 385 27.5.2 SIP Any to WAN Bandwidth Management Example .............................................. 385 27.5.3 SIP WAN to Any Bandwidth Management Example .............................................. 386 27.5.4 HTTP Any to WAN Bandwidth Management Example ........................................... 386 27.5.5 FTP WAN to DMZ Bandwidth Management Example ..................
Table of Contents 29.3 Configuring IDP General ................................................................................................. 418 29.4 Configuring IDP Bindings ................................................................................................ 420 29.5 Introducing IDP Profiles ................................................................................................. 421 29.5.1 Base Profiles ...............................................................................
Table of Contents Chapter 31 Content Filter Screens.......................................................................................................... 463 31.1 Content Filter Overview ................................................................................................... 463 31.1.1 Content Filter Policies ............................................................................................ 463 31.1.2 Content Filter Profiles .........................................................
Table of Contents 34.1.4 Access Users and the ZyWALL .............................................................................. 505 34.1.5 Force User Authentication Policy ........................................................................... 505 34.2 User Summary ................................................................................................................. 506 34.2.1 User Add/Edit ...................................................................................................
Table of Contents 38.2 Directory Service (AD/LDAP) Overview .......................................................................... 532 38.2.1 Directory Structure ................................................................................................. 532 38.2.2 Distinguished Name (DN) ...................................................................................... 533 38.2.3 Configuring Active Directory or LDAP Default Server Settings .............................. 533 38.
Table of Contents Chapter 42 SSL Application .................................................................................................................... 567 42.1 SSL Application Overview ............................................................................................... 567 42.1.1 Application Types ................................................................................................... 567 42.1.2 Remote User Screen Links ......................................................
Table of Contents 44.3 Configuring WWW ........................................................................................................... 589 44.4 Service Control Rules ..................................................................................................... 592 44.5 HTTPS Example .............................................................................................................. 592 44.5.1 Internet Explorer Warning Messages ....................................................
Table of Contents 45.2 Configuration File Screen ................................................................................................ 618 45.3 Firmware Package Screen ............................................................................................. 620 45.4 Shell Script Screen ......................................................................................................... 622 Chapter 46 Logs ...................................................................................
Table of Contents Appendix F Open Software Announcements ....................................................................... 719 Appendix G Legal Information.............................................................................................. 755 Appendix H Customer Support............................................................................................. 759 Index.........................................................................................................................
Table of Contents 30 ZyWALL USG 1000 User’s Guide
List of Figures List of Figures Figure 1 ZyWALL USG 1000 Front Panel .............................................................................................. 53 Figure 2 Managing the ZyWALL: Web Configurator ............................................................................... 54 Figure 3 Applications: VPN Connectivity ................................................................................................ 60 Figure 4 Network Access Mode: Reverse Proxy ..............................
List of Figures Figure 39 VPN Advanced Wizard: Step 3 ............................................................................................. 104 Figure 40 VPN Advanced Wizard: Step 4 ............................................................................................ 106 Figure 41 VPN Advanced Wizard: Step 5 ............................................................................................. 108 Figure 42 VPN Wizard: Step 6: Advanced ..................................................
List of Figures Figure 82 AppPatrol > http > Edit Default ............................................................................................. 144 Figure 83 Object > Schedule > Recurring > add .................................................................................. 145 Figure 84 Firewall > LAN > DMZ > Edit ................................................................................................ 145 Figure 85 Firewall > LAN > DMZ > Add ...............................................
List of Figures Figure 125 Network > Interface > Ethernet > Edit ................................................................................ 190 Figure 126 Network > Interface > Ethernet > Edit > Edit static DHCP table ......................................... 194 Figure 127 Port Grouping Example: Network ....................................................................................... 195 Figure 128 Port Grouping Example: Screen Figure 129 Network > Interface > Port Grouping ...................
List of Figures Figure 168 HTTP Redirect Example ..................................................................................................... 262 Figure 169 Network > HTTP Redirect .................................................................................................. 263 Figure 170 Network > HTTP Redirect > Edit ........................................................................................ 263 Figure 171 H.323 ALG Example .......................................................
List of Figures Figure 211 VPN > IPSec VPN > SA Monitor ........................................................................................ 321 Figure 212 VPN > SSL VPN > Access Privilege ................................................................................. 324 Figure 213 VPN > SSL VPN > Access Privilege > Add/Edit ................................................................ 325 Figure 214 VPN > SSL VPN > Connection Monitor ...............................................................
List of Figures Figure 254 Connect L2TP to ZyWALL: Security ................................................................................... 359 Figure 255 Connect ZyWALL L2TP: Security > Advanced ................................................................... 359 Figure 256 L2TP to ZyWALL Properties > Security .............................................................................. 360 Figure 257 L2TP to ZyWALL Properties > Security > IPSec Settings ............................................
List of Figures Figure 297 LAN to WAN, Outbound 200 kbps, Inbound 500 kbps ...................................................... 382 Figure 298 Bandwidth Management Behavior ..................................................................................... 383 Figure 299 Application Patrol Bandwidth Management Example ......................................................... 385 Figure 300 SIP Any to WAN Bandwidth Management Example ..........................................................
List of Figures Figure 340 Base Profiles ...................................................................................................................... 449 Figure 341 Anti-X > ADP > Profile ........................................................................................................ 449 Figure 342 Smurf Attack ...................................................................................................................... 452 Figure 343 TCP Three-Way Handshake .......................
List of Figures Figure 383 Object > Service > Service > Edit ....................................................................................... 523 Figure 384 Object > Service > Service Group ...................................................................................... 524 Figure 385 Object > Service > Service Group > Edit ............................................................................ 525 Figure 386 Object > Schedule ...............................................................
List of Figures Figure 426 Secure and Insecure Service Access From the WAN ........................................................ 587 Figure 427 HTTP/HTTPS Implementation ............................................................................................ 589 Figure 428 System > WWW ................................................................................................................. 590 Figure 429 System > Service Control Rule Edit .....................................................
List of Figures Figure 469 Maintenance > Log > Log Setting ...................................................................................... 628 Figure 470 Maintenance > Log > Log Setting > E-mail > Edit .............................................................. 630 Figure 471 Maintenance > Log > Log Setting > Remote Server > Edit ................................................ 633 Figure 472 Active Log Summary .......................................................................................
List of Tables List of Tables Table 1 Front Panel LEDs ...................................................................................................................... 54 Table 2 Managing the ZyWALL: Console Port ....................................................................................... 55 Table 3 Starting and Stopping the ZyWALL ........................................................................................... 55 Table 4 Packet Flow Key .........................................
List of Tables Table 39 Licensing > Registration ........................................................................................................ 167 Table 40 Licensing > Registration > Service ....................................................................................... 168 Table 41 Licensing > Update > IDP/AppPatrol .................................................................................... 173 Table 42 Licensing > Update > System Protect ........................................
List of Tables Table 82 Network > HTTP Redirect > Edit ........................................................................................... 263 Table 83 Network > ALG ...................................................................................................................... 270 Table 84 Default Firewall Rules ........................................................................................................... 279 Table 85 Blocking All LAN to WAN IRC Traffic Example ..................
List of Tables Table 125 Anti-X > Anti-Virus > Setting > Black List Add ................................................................... 413 Table 126 Anti-X > Anti-Virus > Signature ........................................................................................... 414 Table 127 Anti-X > IDP > General ....................................................................................................... 419 Table 128 Anti-X > IDP > General > Add ..................................................
List of Tables Table 168 Object > Address > Address Group > Add .......................................................................... 518 Table 169 Object > Service > Service ................................................................................................. 522 Table 170 Object > Service > Service > Edit ....................................................................................... 523 Table 171 Object > Service > Service Group ...................................................
List of Tables Table 211 SNMP Traps ........................................................................................................................ 607 Table 212 System > SNMP .................................................................................................................. 608 Table 213 System > Dial-in Mgmt ........................................................................................................ 610 Table 214 System > Vantage CNM ....................................
List of Tables Table 254 Interface Logs ..................................................................................................................... 699 Table 255 Account Logs ...................................................................................................................... 701 Table 256 Port Grouping Logs ............................................................................................................. 701 Table 257 Force Authentication Logs .........................
List of Tables 50 ZyWALL USG 1000 User’s Guide
P ART I Introduction Introducing the ZyWALL (53) Features and Applications (57) Web Configurator (65) Configuration Basics (111) Tutorials (125) Status (157) Registration (165) Update (171) 51
CHAPTER 1 Introducing the ZyWALL This chapter gives an overview of the ZyWALL. It explains the front panel ports, LEDs, introduces the management methods, and lists different ways to start or stop the ZyWALL. 1.1 Overview and Key Default Settings The ZyWALL is an Internet Security Gateway designed for Small and Medium Businesses (SMB). Its flexible configuration helps network administrators set up the network and enforce security policies efficiently.
Chapter 1 Introducing the ZyWALL The following table describes the LEDs. Table 1 Front Panel LEDs LED COLOR STATUS DESCRIPTION Off The ZyWALL is turned off. Green On The ZyWALL is turned on. Red On There is a hardware component failure. Shut down the device, wait for a few minutes and then restart the device (see Section 1.4 on page 55). If the LED turns red again, then please contact your vendor. Green Off The ZyWALL is not ready or has failed. On The ZyWALL is ready and running.
Chapter 1 Introducing the ZyWALL Command-Line Interface (CLI) The CLI allows you to use text-based commands to configure the ZyWALL. You can access it using remote management (for example, SSH or Telnet) or via the console port. See the Command Reference Guide for more information about the CLI. Console Port You can use the console port to manage the ZyWALL. You have to use CLI commands, which are explained in the Command Reference Guide. The default settings for the console port are as follows.
Chapter 1 Introducing the ZyWALL " It is recommended you use the shutdown command before turning off the ZyWALL. When you apply configuration files or running shell scripts, the ZyWALL does not stop or start the system processes. However, you might lose access to network resources temporarily while the ZyWALL is applying configuration files or running shell scripts.
CHAPTER 2 Features and Applications This chapter introduces the main features and applications of the ZyWALL. 2.1 Features The ZyWALL’s security features include VPN, firewall, anti-virus, content filtering, IDP (Intrusion Detection and Prevention), ADP (Anomaly Detection and Protection), and certificates. It also provides bandwidth management, NAT, port forwarding, policy routing, DHCP server and many other powerful features.
Chapter 2 Features and Applications Intrusion Detection and Prevention (IDP) IDP (Intrusion Detection and Protection) can detect malicious or suspicious packets and respond instantaneously. It detects pattern-based attacks in order to protect against networkbased intrusions. See Section 29.8.2 on page 427 for a list of attacks that the ZyWALL can protect against. You can also create your own custom IDP rules.
Chapter 2 Features and Applications Table 4 Packet Flow Key AC Application Classifier is the Application Protocol (AP) layer-7 classifier. DNAT Destination NAT Routing Routing includes policy routes, interface routing, static routes and load balancing for example.
Chapter 2 Features and Applications Ethernet -> VLAN -> Encap -> ALG -> AC -> DNAT-> Routing -> FW -> AC -> IDP -> AV -> AP -> CF -> SNAT -> IPSec E -> Routing -> BWM -> Encap -> VLAN -> Ethernet 2.3 Applications These are some example applications for your ZyWALL. See also Chapter 6 on page 125 for configuration tutorial examples. 2.3.1 VPN Connectivity Set up VPN tunnels with other companies, branch offices, telecommuters, and business travelers to provide secure access to your network.
Chapter 2 Features and Applications With reverse proxy mode, remote users can easily access any web-based applications on the local network by clicking on links or entering the provided URL. You do not have to install additional client software on the remote user computers for access. Figure 4 Network Access Mode: Reverse Proxy 2.3.2.2 Full Tunnel Mode In full tunnel mode, a virtual connection is created for remote users with private IP addresses in the same subnet as the local network.
Chapter 2 Features and Applications Figure 6 Applications: User-Aware Access Control 2.3.4 Multiple WAN Interfaces Set up multiple connections to the Internet on the same port, or set up multiple connections on different ports. In either case, you can balance the loads between them. Figure 7 Applications: Multiple WAN Interfaces 2.3.5 Device HA Set up an additional ZyWALL as a backup gateway to ensure the default gateway is always available for the network.
Chapter 2 Features and Applications Figure 8 Applications: Device HA ZyWALL USG 1000 User’s Guide 63
Chapter 2 Features and Applications 64 ZyWALL USG 1000 User’s Guide
CHAPTER 3 Web Configurator The ZyWALL web configurator allows easy ZyWALL setup and management using an Internet browser. 3.1 Web Configurator Requirements In order to use the web configurator, you must • • • • • Use Internet Explorer 6.0 or later, Netscape Navigator 7.2 or later, or Firefox 1.0.
Chapter 3 Web Configurator Figure 9 Login Screen 3 Type the user name (default: “admin”) and password (default: “1234”). If your account is configured to use an ASAS authentication server, use the OTP (OneTime Password) token to generate a number. Enter it in the One-Time Password field. The number is only good for one login. You must use the token to generate a new number the next time you log in. 4 Click Login.
Chapter 3 Web Configurator 5 The screen above appears every time you log in using the default user name and default password. If you change the password for the default user account, this screen does not appear anymore. Follow the directions in this screen. If you change the default password, the Login screen (Figure 9 on page 66) appears after you click Apply. If you click Ignore, the main screen appears. Figure 11 Main Screen A C B D 3.
Chapter 3 Web Configurator The icons provide the following functions. Table 5 Title Bar: Web Configurator Icons ICON DESCRIPTION Help: Click this icon to open the help page for the current screen. Wizards: Click this icon to open one of the web configurator wizards. See Chapter 4 on page 75 for more information. Console: Click this icon to open the console in which you can use the command line interface (CLI). Site Map: Click this icon to display the site map for the web configurator.
Chapter 3 Web Configurator Table 6 Navigation Panel Summary (continued) LINK Routing TAB FUNCTION Policy Route Use this screen to create and manage routing policies. Static Route Use this screen to create and manage IP static routing information. RIP Use this screen to configure device-level RIP settings. OSPF Use this screen to configure device-level OSPF settings, including areas and virtual links. Zone Use this screen to configure zones used to define various policies.
Chapter 3 Web Configurator Table 6 Navigation Panel Summary (continued) LINK IDP ADP Content Filter Device HA TAB FUNCTION General Use this screen to look at and manage IDP bindings. Profile Use this screen to create and manage IDP profiles. Custom Signatures Use this screen to create, import, or export custom signatures. General Use this screen to look at and manage ADP bindings. Profile Use this screen to create and manage ADP profiles.
Chapter 3 Web Configurator Table 6 Navigation Panel Summary (continued) LINK TAB FUNCTION Host Name Use this screen to configure the system and domain name for the ZyWALL. Date/Time Use this screen to configure the current date, time, and time zone in the ZyWALL. Console Speed Use this screen to set the console speed. DNS Use this screen to configure the DNS server and address records for the ZyWALL. WWW Use this screen to configure HTTP, HTTPS, and general authentication.
Chapter 3 Web Configurator 3.3.4 Message Bar Check the message bar when you click Apply or OK to verify that the configuration has been updated. Figure 12 Message Bar 3.3.4.1 Warning Messages Click the up arrow to view the ZyWALL’s current warning messages. These warning messages display in a popup window, such as the following. Figure 13 Warning Messages Click Refresh Now to update the screen. Close the popup window when you are done with it.
Chapter 3 Web Configurator Figure 14 CLI Messages Click Change Display Style to show or hide the index numbers for the commands (the commands are more convenient to copy and paste without the index numbers). Click Refresh Now to update the screen. For example, if you just enabled a particular feature, you can look at the commands the web configurator generated to enable it. Close the popup window when you are done with it. See the Command Reference Guide for information about the commands.
Chapter 3 Web Configurator 74 ZyWALL USG 1000 User’s Guide
CHAPTER 4 Wizard Setup This chapter provides information on configuring the Wizard setup screens in the web configurator. See the feature-specific chapters in this User’s Guide for background information. 4.1 Wizard Setup Overview " Use the wizards only for initial configuration starting from the default configuration. The web configurator's setup wizards help you configure Internet and VPN connection settings.
Chapter 4 Wizard Setup Use VPN SETUP to configure a VPN connection. See Section 4.6 on page 95. Figure 15 Wizard Setup Welcome 4.2 Installation Setup, One ISP The wizard screens vary depending on what encapsulation type you use. Refer to information provided by your ISP to know what to enter in each field. Leave a field blank if you don’t have that information. " 76 Enter the Internet access information exactly as your ISP gave it to you.
Chapter 4 Wizard Setup Figure 16 Internet Access: Step 1 The following table describes the labels in this screen. Table 7 Internet Access: Step 1 LABEL DESCRIPTION ISP Parameters Encapsulation Choose the Ethernet option when the WAN port is used as a regular Ethernet. Otherwise, choose PPPoE or PPTP for a dial-up connection according to the information from your ISP. WAN IP Address Assignments WAN Interface This is the interface you are configuring for Internet access.
Chapter 4 Wizard Setup IP Address Assignment: Select Auto If your ISP did not assign you a fixed IP address. Select Static If the ISP assigned a fixed IP address. 4.3.1 Ethernet: Auto IP Address Assignment If you select Auto as the IP Address Assignment in the previous screen, the following screen displays. Click Next to apply the configuration settings. Figure 17 Ethernet Encapsulation: Auto: Finish You have set up your ZyWALL to access the Internet.
Chapter 4 Wizard Setup Figure 18 Ethernet Encapsulation: Static The following table describes the labels in this screen. Table 8 Ethernet Encapsulation: Static LABEL DESCRIPTION ISP Parameters Encapsulation This displays the type of Internet connection you are configuring. WAN IP Address Assignments WAN Interface This displays the identity of the interface you configure to connect with your ISP. Zone This field displays to which security zone this interface and Internet connection will belong.
Chapter 4 Wizard Setup 4.3.3 Step 2 Internet Access Ethernet You do not configure this screen if you selected Auto as the IP Address Assignment in the previous screen. " Enter the Internet access information exactly as given to you by your ISP. WAN Interface: This is the number of the interface that will connect with your ISP. Zone: This is the security zone to which this interface and Internet connection will belong. IP Address: Enter your (static) public IP address.
Chapter 4 Wizard Setup You can click Next and use the following screen to perform a basic registration (see Section 4.4 on page 91). If you want to do a more detailed registration or manage your account details, click myZyXEL.com. Alternatively, click Close to exit the wizard. 4.3.4 PPPoE: Auto IP Address Assignment If you select Auto as the IP Address Assignment in the previous screen, the following screen displays after you click Next.
Chapter 4 Wizard Setup Table 9 PPPoE Encapsulation: Auto (continued) LABEL DESCRIPTION Idle Timeout Type the time in seconds that elapses before the router automatically disconnects from the PPPoE server. The default time is 100 seconds. WAN IP Address Assignments WAN Interface This displays the identity of the interface you configure to connect with your ISP. Zone This field displays to which security zone this interface and Internet connection will belong.
Chapter 4 Wizard Setup Figure 22 PPPoE Encapsulation: Static The following table describes the labels in this screen. Table 10 PPPoE Encapsulation: Static LABEL DESCRIPTION ISP Parameters Encapsulation This displays the type of Internet connection you are configuring. Service Name Type the PPPoE service name given to you by your ISP. PPPoE uses a service name to identify and reach the PPPoE server. You can use alphanumeric and _@$./ characters, and it can be up to 64 characters long.
Chapter 4 Wizard Setup Table 10 PPPoE Encapsulation: Static (continued) LABEL DESCRIPTION First DNS Server Second DNS Server Enter the DNS server's IP address(es) in the field(s) to the right. Leave the field as 0.0.0.0 if you do not want to configure DNS servers. If you do not configure a DNS server, you must know the IP address of a machine in order to access it. Next Click Next to continue. 4.3.
Chapter 4 Wizard Setup Figure 23 PPPoE Encapsulation: Static: Finish You have set up your ZyWALL to access the Internet. " If you have not already done so, you can register your ZyWALL with myZyXEL.com and activate trials of services like IDP. You can click Next and use the following screen to perform a basic registration (see Section 4.4 on page 91). If you want to do a more detailed registration or manage your account details, click myZyXEL.com. Alternatively, click Close to exit the wizard. 4.3.
Chapter 4 Wizard Setup Figure 24 PPTP Encapsulation: Auto The following table describes the labels in this screen. Table 11 PPTP Encapsulation: Auto LABEL DESCRIPTION ISP Parameters Encapsulation This displays the type of Internet connection you are configuring. User Name Type the user name given to you by your ISP. You can use alphanumeric and _@$./ characters, and it can be up to 31 characters long. Password Type the password associated with the user name above.
Chapter 4 Wizard Setup Table 11 PPTP Encapsulation: Auto (continued) LABEL DESCRIPTION Connection ID Enter the connection ID or connection name in this field. It must follow the "c:id" and "n:name" format. For example, C:12 or N:My ISP. This field is optional and depends on the requirements of your DSL modem. You can use alphanumeric and -_: characters, and it can be up to 31 characters long.
Chapter 4 Wizard Setup " If you have not already done so, you can register your ZyWALL with myZyXEL.com and activate trials of services like IDP. You can click Next and use the following screen to perform a basic registration (see Section 4.4 on page 91). If you want to do a more detailed registration or manage your account details, click myZyXEL.com. Alternatively, click Close to exit the wizard. 4.3.
Chapter 4 Wizard Setup Table 12 PPTP Encapsulation: Static (continued) LABEL DESCRIPTION User Name Type the user name given to you by your ISP. You can use alphanumeric and _@$./ characters, and it can be up to 31 characters long. Password Type the password associated with the user name above. Use up to 64 ASCII characters except the [] and ?. Retype to Confirm Type your password again for confirmation. Nailed-Up Select Nailed-Up if you do not want the connection to time out.
Chapter 4 Wizard Setup Type the Password associated with the user name. Select Nailed-Up if you do not want the connection to time out. Otherwise, type the Idle Timeout in seconds that elapses before the router automatically disconnects from the PPTP server. 4.3.9.2 PPTP Configuration Base Interface: This is the identity of the Ethernet interface you configure to connect with a modem or router. Type a Base IP Address (static) assigned to you by your ISP.
Chapter 4 Wizard Setup 4.3.10 Step 4 Internet Access - Finish You have set up your ZyWALL to access the Internet. " If you have not already done so, you can register your ZyWALL with myZyXEL.com and activate trials of services like IDP. You can click Next and use the following screen to perform a basic registration (see Section 4.4 on page 91). If you want to do a more detailed registration or manage your account details, click myZyXEL.com. Alternatively, click Close to exit the wizard. 4.
Chapter 4 Wizard Setup Figure 28 Registration The following table describes the labels in this screen. Table 13 Registration LABEL DESCRIPTION Device Registration If you select existing myZyXEL.com account, only the User Name and Password fields are available. new myZyXEL.com account If you haven’t created an account at myZyXEL.com, select this option and configure the following fields to create an account and register your ZyWALL. existing myZyXEL.
Chapter 4 Wizard Setup Table 13 Registration (continued) LABEL DESCRIPTION Close Click Close to exit the wizard. Next Click Next to save your changes back to the ZyWALL and activate the selected services. Figure 29 Registration: Registered Device 4.5 Installation Setup, Two Internet Service Providers This wizard allows you to configure two interfaces for Internet access through either two different Internet Service Providers (ISPs) or two different accounts with the same ISP.
Chapter 4 Wizard Setup Figure 30 Internet Access: Step 1: First WAN Interface After you configure the First WAN Interface, you can configure the Second WAN Interface. Click Next to continue. Figure 31 Internet Access: Step 3: Second WAN Interface After you configure the Second WAN Interface, a summary of configuration settings display for both WAN interfaces.
Chapter 4 Wizard Setup Figure 32 Internet Access: Finish " You can register your ZyWALL with myZyXEL.com and activate trials of services like IDP. Use the myZyXEL.com link if you do already have a myZyXEL.com account. If you already have a myZyXEL.com account, you can click Next and use the following screen to register your ZyWALL and activate service trials (see Section 4.4 on page 91). Alternatively, click Close to exit the wizard. 4.5.
Chapter 4 Wizard Setup Click VPN SETUP in the Wizard Setup Welcome screen (Figure 15 on page 76) to open the following screen. Use it to select which type of VPN settings you want to configure. Figure 33 VPN Wizard: Wizard Type The following table describes the labels in this screen. Table 14 VPN Wizard: Step 1: Wizard Type LABEL DESCRIPTION Express Use this wizard to create a VPN connection with another ZLD-based ZyWALL using a pre-shared key and default security settings.
Chapter 4 Wizard Setup 4.7.1 VPN Express Wizard Click the Express radio button as shown in Figure 33 on page 96 to display the following screen. Figure 34 VPN Express Wizard: Step 2 The following table describes the labels in this screen. Table 15 VPN Express Wizard: Step 2 LABEL DESCRIPTION Name Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number.
Chapter 4 Wizard Setup Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Secure Gateway: Enter the WAN IP address or domain name of the remote IPSec router (secure gateway). Use 0.0.0.0 if the remote IPSec router has a dynamic WAN IP address and no domain name. Pre-Shared Key: Type the password.
Chapter 4 Wizard Setup 4.8.1 VPN Express Wizard - Policy Setting The Policy Setting specifies which devices can use the VPN tunnel. Local and remote IP addresses must be static. Local Policy (IP/Mask): Type the IP address of a computer on your network. You can also specify a subnet. This must match the remote IP address configured on the peer IPSec device. Remote Policy (IP/Mask): Type the IP address of a computer behind the peer IPSec device. You can also specify a subnet.
Chapter 4 Wizard Setup Table 17 VPN Express Wizard: Step 4 (continued) LABEL DESCRIPTION Configuration for Remote Gateway These commands set the matching VPN connection settings for the remote gateway. If the remote gateway is a ZLD-based ZyWALL, you can copy and paste this list into its command line interface in order to configure it for the VPN tunnel. You can also use a text editor to save these commands as a shell script file with a “.zysh” filename extension.
Chapter 4 Wizard Setup " If you have not already done so, use the myZyXEL.com link and register your ZyWALL with myZyXEL.com and activate trials of services like IDP. Alternatively, click Close to exit the wizard. 4.8.3 VPN Express Wizard - Finish Now you can use the VPN tunnel. " If you have not already done so, you can register your ZyWALL with myZyXEL.com and activate trials of services like IDP. You can click Next and use the following screen to perform a basic registration (see Section 4.
Chapter 4 Wizard Setup Figure 38 VPN Advanced Wizard: Step 2 The following table describes the labels in this screen. Table 18 VPN Advanced Wizard: Step 2 LABEL DESCRIPTION Remote Gateway Name Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 4 Wizard Setup Table 18 VPN Advanced Wizard: Step 2 (continued) LABEL DESCRIPTION Certificate Use the drop-down list box to select the certificate to use for this VPN tunnel. You must have certificates already configured in the My Certificates screen. Click Certificate under the Object menu to go to the My Certificates screen where you can view the ZyWALL's list of certificates. Next Click Next to continue. 4.8.
Chapter 4 Wizard Setup Figure 39 VPN Advanced Wizard: Step 3 The following table describes the labels in this screen. Table 19 VPN Advanced Wizard: Step 3 LABEL DESCRIPTION Negotiation Mode Select Main for identity protection. Select Aggressive to allow more incoming connections from dynamic IP addresses to use separate passwords. Note: Multiple SAs (security associations) connecting through a secure gateway must have the same negotiation mode.
Chapter 4 Wizard Setup Table 19 VPN Advanced Wizard: Step 3 (continued) LABEL DESCRIPTION SA Life Time (Seconds) Define the length of time before an IKE SA automatically renegotiates in this field. The minimum value is 60 seconds. A short SA Life Time increases security by forcing the two VPN gateways to update the encryption and authentication keys. However, every time the VPN tunnel renegotiates, all users accessing remote resources are temporarily disconnected.
Chapter 4 Wizard Setup 4.8.6.1 Phase 2 Setting Phase 2 in an IKE uses the SA that was established in phase 1 to negotiate SAs for IPSec. Figure 40 VPN Advanced Wizard: Step 4 The following table describes the labels in this screen. Table 20 VPN Advanced Wizard: Step 4 LABEL DESCRIPTION Phase 2 Setting Active Protocol Select the security protocols used for an SA. Both AH and ESP increase ZyWALL processing requirements and communications latency (delay).
Chapter 4 Wizard Setup Table 20 VPN Advanced Wizard: Step 4 (continued) LABEL DESCRIPTION SA Life Time (Seconds) Define the length of time before an IKE SA automatically renegotiates in this field. The minimum value is 60 seconds. A short SA Life Time increases security by forcing the two VPN gateways to update the encryption and authentication keys. However, every time the VPN tunnel renegotiates, all users accessing remote resources are temporarily disconnected.
Chapter 4 Wizard Setup Figure 41 VPN Advanced Wizard: Step 5 The following table describes the labels in this screen. Table 21 VPN Advanced Wizard: Step 5 LABEL DESCRIPTION Summary Name This is the name of the VPN connection (and VPN gateway). Secure Gateway This is the WAN IP address or domain name of the remote IPSec router. If this field displays 0.0.0.0, only the remote IPSec router can initiate the VPN connection.
Chapter 4 Wizard Setup Secure Gateway: IP address or domain name of the peer IPSec device. Pre-Shared Key: VPN tunnel password. Local Policy: IP address and subnet mask of the computers on the network behind your ZyWALL that can use the tunnel. Remote Policy: IP address and subnet mask of the computers on the network behind the peer IPSec device that can use the tunnel. Copy and paste the Remote Gateway CLI commands into another ZLD-based ZyWALL’s command line interface. Click Save to save the VPN rule.
Chapter 4 Wizard Setup " If you have not already done so, you can register your ZyWALL with myZyXEL.com and activate trials of services like IDP. You can click Next and use the following screen to perform a basic registration (see Section 4.4 on page 91). If you want to do a more detailed registration or manage your account details, click myZyXEL.com. Alternatively, click Close to exit the wizard.
CHAPTER 5 Configuration Basics This section provides information to help you configure the ZyWALL effectively. Some of it is helpful when you are just getting started. Some of it is provided for your reference when you configure various features in the ZyWALL. • Section 5.1 on page 111 introduces (very briefly) how granular the configuration is in the ZyWALL. • Section 5.
Chapter 5 Configuration Basics 5.2 Terminology in the ZyWALL This section highlights some differences in terminology or organization between the ZyWALL and other routers, particularly ZyNOS routers.
Chapter 5 Configuration Basics A physical port is the place to which you connect the cable. As shown above, you do not usually configure physical ports to use various features. You configure interfaces and zones. The ZyWALL supports one-to-one, one-to-many, many-to-one, and many-to-none relationships between physical ports and interfaces. There are many types of interfaces in the ZyWALL.
Chapter 5 Configuration Basics Figure 43 Interfaces and Zones: Example • The LAN zone contains the ge1 (Gigabit Ethernet 1) interface. This is a protected zone and uses private IP addresses. ge1 uses 192.168.1.1 and the connected devices use IP addresses in the 192.168.1.2 to 192.168.1.254 range. • The WAN zone contains interfaces ge2 and ge3. They use public IP addresses to connect to the Internet. • The DMZ zone contains interface ge4. The DMZ zone has servers that are available to the public.
Chapter 5 Configuration Basics PREREQUISITES These are other features you should configure before you configure the main screen(s) for this feature. If you did not configure one of the prerequisites first, you can often select an option to create a new object. After you create the object you return to the main screen to finish configuring the feature. You may not have to configure everything in the list of prerequisites.
Chapter 5 Configuration Basics PREREQUISITES Interfaces WHERE USED Policy routes Example: See Chapter 6 on page 125. 5.4.4 IPSec VPN Use IPSec VPN to provide secure communication between two sites over the Internet or any insecure network that uses TCP/IP for communication. The ZyWALL also offers hub-andspoke VPN. MENU ITEM(S) VPN > IPSec VPN; you can also use the VPN Setup Wizard, which handles most of the prerequisites for you.
Chapter 5 Configuration Basics Zones cannot overlap. Each interface and VPN tunnel can be assigned to at most one zone. Virtual interfaces are automatically assigned to the same zone as the interface on which they run. When you create a zone, the ZyWALL does not create any firewall rules, assign an IDP profile, or configure remote management for the new zone.
Chapter 5 Configuration Basics 2 Click Network > Routing > Policy Route to go to the policy route configuration screen. Add a policy route. 3 Name the policy route. 4 Select the interface that the traffic comes in through (ge4 in this example). 5 Select the FTP server’s address as the source address. 6 You don’t need to specify the destination address or the schedule. 7 For the service, select FTP.
Chapter 5 Configuration Basics 2 Create an address object for the VoIP server (Object > Address). 3 Click Firewall to go to the firewall configuration. 4 Select from the DMZ-2 zone to the LAN zone, and add a firewall rule using the items you have configured. • You don’t need to specify the schedule or the user. • In the Source field, select the address object of the VoIP server. • You don’t need to specify the destination address. • Leave the Access field set to Allow and the Log field set to No.
Chapter 5 Configuration Basics 5.4.14 Anti-Virus Use anti-virus to detect and take action on viruses. You must subscribe to use anti-virus. You can subscribe using the Licensing > Registration screens or one of the wizards. MENU ITEM(S) Anti-X > AV PREREQUISITES Registration, zones 5.4.15 IDP Use IDP to detect and take action on malicious or suspicious packets. You must subscribe to use IDP. You can subscribe using the Licensing > Registration screens or one of the wizards.
Chapter 5 Configuration Basics 11 Add a policy that uses the schedule, the filtering profile and the user that you created. 5.4.18 Virtual Server (Port Forwarding) Use this to change the address and/or port number of packets coming in from a specified interface. This is also known as port forwarding. The ZyWALL does not check to-ZyWALL firewall rules for packets that are redirected by virtual server. It does check regular (through-ZyWALL) firewall rules.
Chapter 5 Configuration Basics 5.4.20 ALG The ZyWALL’s Application Layer Gateway (ALG) allows VoIP and FTP applications to go through NAT on the ZyWALL. You can also specify additional signaling port numbers. MENU ITEM(S) Network > ALG 5.5 Objects Objects store information and are referenced by other features. If you update this information in response to changes, the ZyWALL automatically propagates the change through the features that use the object. The following table introduces the objects.
Chapter 5 Configuration Basics Table 28 User Types TYPE ABILITIES Guest Access network services Ext-User The same as a User or a Guest. The ZyWALL looks for the specific type in an external authentication server. If the type is not available, the ZyWALL applies default settings. If you want to force users to log in to the ZyWALL before the ZyWALL routes traffic for them, you might have to configure prerequisites first.
Chapter 5 Configuration Basics 5.6.2 File Manager Use these screens to upload, download, delete, or run scripts of CLI commands. You can manage • Configuration files. Use configuration files to back up and restore the complete configuration of the ZyWALL. You can store multiple configuration files in the ZyWALL and switch between them without restarting. • Shell scripts. Use shell scripts to run a series of CLI commands.
CHAPTER 6 Tutorials This chapter provides some examples of using the web configurator to set up features in the ZyWALL. See also Chapter 26 on page 351 for an example of configuring L2TP. 6.1 Interfaces and Zones The following example shows how to use port grouping, Ethernet interfaces, trunks, and zones to set up the following configuration. Table 29 Interfaces and Zones Example PHYSICAL PORT ETHERNET INTERFACE SETTINGS TRUNK ZONE 1 ge1 192.168.1.
Chapter 6 Tutorials Figure 44 Network > Interface > Port Grouping, Initial 2 Drag physical port 2 onto representative interface ge1, as shown below. Figure 45 Network > Interface > Port Grouping, Drag-and-Drop 3 Click Apply. 4 Click Status, and look at the Interface Status Summary, shown below. Ethernet interface ge1 has a status of Port Group Up, and Ethernet interface ge2 is disabled and has a Status of Port Group Inactive.
Chapter 6 Tutorials Figure 46 Status: Interface Status Summary After Port Grouping 6.1.2 Set up Ethernet Interfaces This example sets up the Ethernet interfaces as shown below. Table 30 Ethernet Interfaces Example ETHERNET INTERFACE SETTINGS ge1 192.168.1.1/24, DHCP server ge3 DHCP client ge4 172.23.37.240/24 ge5 10.0.0.1/24, DHCP server You have decided to use the default settings for ge1 and ge3, so it is not necessary to edit these interfaces.
Chapter 6 Tutorials Figure 48 Network > Interface > Ethernet > ge4 3 Use the default values for the rest of the settings. Click Apply to save these changes and return to the previous screen. Click the Edit icon for ge5, and set up the IP address as shown below. Figure 49 Network > Interface > Ethernet > ge5 > IP Address Assignment 4 Scroll down to the DHCP Setting section, and set up the DHCP server for ge5, as shown below.
Chapter 6 Tutorials Figure 51 Status > Interface Status Summary, After Ethernet Interface Edits 6.1.3 WAN Trunk This example sets up trunk WAN_TRUNK with ge3 and ge4. This example uses the default settings for the trunk and shows how to add the interfaces to it. Table 31 Trunk Example ETHERNET INTERFACE TRUNK ge1 --- ge3 WAN_TRUNK ge4 WAN_TRUNK ge5 --- There are no existing trunks at the beginning of this example. 1 Click Network > Interface > Trunk. The following screen appears.
Chapter 6 Tutorials Figure 54 Network > Interface > Trunk > Edit > Member 4 Use the default values for the rest of the settings. Click OK to save these changes and return to the previous screen. 6.1.4 Zones This example sets up the LAN, WAN, and DMZ zones as shown below.
Chapter 6 Tutorials Figure 56 Network > Zone > DMZ, Remove ge4 3 Select IFACE/ge4 and click the left arrow to remove ge4 from the Member list. Click OK to save these changes and return to the previous screen. 4 Click the Edit icon for WAN. The following screen appears. Figure 57 Network > Zone > WAN, Add ge4 5 Select IFACE/ge4 and click the right arrow to add ge4 to the Member list. Click OK to save these changes and return to the previous screen.
Chapter 6 Tutorials 6.2 IPSec VPN This example is going to show you how to create the VPN tunnel illustrated below. Figure 59 VPN Example 172.23.37.240 220.123.143.10/24 192.168.1.33 ~ 192.168.1.232 192.168.10.0/24 In this example, the ZyWALL is router X (172.23.37.240/24), and the remote IPSec router is router Y (220.123.143.10/24). Create the VPN tunnel between IP addresses 192.168.1.33 to 192.168.1.232 on our local network A and the remote network B (192.168.10.0/24).
Chapter 6 Tutorials Figure 60 VPN > IPSec VPN > VPN Gateway > Add 6.2.3 Set up the VPN Connection The VPN connection manages the IPSec SA. You have to set up the address objects for the local network and remote network before you can set up the VPN connection. 1 Click Object > Address > Address. Click the Add icon. 2 Give the new address object a name (“VPN_LOCAL_RANGE”), change the Address Type to RANGE, and set up the rest of the fields to 192.168.1.33 and 192.168.1.232. Click OK.
Chapter 6 Tutorials Figure 62 VPN > IPSec VPN > VPN Connection > add 6.2.4 Set up the Policy Route for the VPN Tunnel You should create a new policy route to use the VPN tunnel. This policy route will only use the existing address objects, so you do not have to create any additional objects first. 1 Click Network > Routing > Policy Route.
Chapter 6 Tutorials Figure 64 Network > Routing > Policy Route > Add Because the new VPN connection has not been assigned to a zone yet, there are no restrictions (for example, firewall) on traffic to or from this VPN connection. You should set up the VPN settings on the remote IPSec router and try to establish the VPN tunnel before continuing. 6.2.5 Set up the Zone for the VPN Tunnel The new VPN connection has not been assigned to a zone yet.
Chapter 6 Tutorials 6.3 Device HA This example is going to show you how to set up device HA as illustrated below. Figure 66 Device HA Example 192.168.1.1 192.168.1.101 In this example, router A is the default gateway for the network and uses IP address 192.168.1.1. This is the default gateway IP address for the network. There are two ZyWALL routers to ensure this gateway is available. Router A is the master; router B is the backup. Router B has a management IP address of 192.168.1.101.
Chapter 6 Tutorials Figure 67 Device HA > VRRP Group > Add: ge1 3 Click Status, and scroll down to the Interface Status Summary. The H/A Status field is Active. Figure 68 Status: Interface Status Summary: Device HA Master Configured 4 Repeat these steps for the interface that is connected to the Internet. The second VRRP group should have a different VR ID. Part of an example using ge4 is shown below.
Chapter 6 Tutorials Figure 69 Network > Device HA > VRRP Group > Add: ge4 " Once you configure an interface in a VRRP group, you should not configure the interface to have a dynamic IP address. 6.3.3 Set up the Password for Synchronization 1 Click Device HA > Synchronize. 2 Type the password for synchronization in the Password field. This password does not have to be the same as the password for the admin account, but you have to set the same password in the master and backup. Click Apply.
Chapter 6 Tutorials 6.3.4 Finish Configuring the Master Finish configuring the master. The backup router will get these updates later, when it synchronizes with the master. 6.3.5 Set up the Ethernet Interfaces on the Backup On the backup ZyWALL, ge1 should be configured exactly the same way it is configured on the master, including the same IP address. Therefore, you should not configure the backup while it is connected to the same network as the master, or there will be an IP address conflict.
Chapter 6 Tutorials 6.3.7 Synchronize the Backup 1 Connect the backup to the same network as the master. 2 Click Device HA > Synchronize. 3 Type the password for synchronization in the Password field. Enter the IP address of the master (on a secure network), and click Sync Now to get the configuration from the master. Figure 73 Device HA > Synchronize You can also set up the backup to synchronize with the master at regular intervals. 6.
Chapter 6 Tutorials 6.4.1 Set up User Accounts Set up one user account for each user account in the RADIUS server. If it is possible to export user names from the RADIUS server to a text file, then you might create a script to create the user accounts instead. This example uses the web configurator. 1 Click User/Group > User. Click the Add icon. 2 Enter the same user name that is used in the RADIUS server, and set the User Type to Ext-User because this user account is authenticated by an external server.
Chapter 6 Tutorials 6.4.3 Set up User Authentication Using the RADIUS Server This step sets up user authentication using the RADIUS server. First, configure the settings for the RADIUS server. Then, set up the authentication method, and configure the ZyWALL to use the authentication method. Finally, force users to log in to the ZyWALL before it routes traffic for them. 1 Click Object > AAA Server > RADIUS > Default. Configure the RADIUS server, and click Apply.
Chapter 6 Tutorials " The users will have to log in using the web configurator login screen before they can use HTTP or MSN. Figure 79 Object > User/Group > Setting > Add (Force User Authentication Policy) When the users try to browse the web (or use any HTTP/HTTPS application), the Login screen appears. They have to log in using the user name and password in the RADIUS server. 6.4.
Chapter 6 Tutorials Figure 81 AppPatrol > http > Edit Default 4 Click the Add icon in the policy list. In the new policy, select one of the user groups that is allowed to browse the web and set the corresponding bandwidth restriction in the Inbound and Outbound fields. Click OK. Repeat this process to add exceptions for all the other user groups that are allowed to browse the web. Figure 82 AppPatrol > http > Edit Default 6.4.
Chapter 6 Tutorials Figure 83 Object > Schedule > Recurring > add 3 Follow the steps in Section 6.4.4 on page 143 to set up the appropriate policies for MSN in application patrol. Make sure to specify the schedule when you configure the policy for the Sales group’s MSN access. 6.4.6 Set up LAN-to-DMZ Policies Use the firewall to control access to the DMZ. 1 Click Firewall. In From Zone, select LAN; in To Zone, select DMZ. The default rule for LAN-to-DMZ traffic allows all traffic.
Chapter 6 Tutorials Figure 85 Firewall > LAN > DMZ > Add 5 Repeat this process to set up firewall rules for the other user groups that are allowed to access the DMZ. 6.5 Trunks The following example shows how to set up a trunk for two connections (ge2 and ge3) to the Internet. The available bandwidth for each connections is 1Mbps (ge2) and 512 Kbps (ge3).
Chapter 6 Tutorials Figure 87 Network > Interface > Ethernet > Edit > ge2 2 Click the Edit icon for ge3, and enter the available bandwidth (512 kbps) in the Upstream Bandwidth and Downstream Bandwidth fields. Click OK. 6.5.2 Change WAN Trunk Algorithm 1 Click Network > Interface > Trunk. Click the Edit icon next to WAN_TRUNK. 2 In the Load Balancing Algorithm field, select Weighted Round Robin. After the screen refreshes, enter 2 and 1 in the Weight column for ge2 and ge3, respectively. Click OK.
Chapter 6 Tutorials The firewall is enabled, so you also need to create a rule to allow traffic in from the WAN zone. Figure 89 NAT 1:1 Example Network Topology 192.168.1.21 1.1.1.1 6.6.1 NAT 1:1 Address Objects First create two address objects for the private and public IP addresses (LAN_SMTP and WAN_EG) in the Object > Address screen as shown next.
Chapter 6 Tutorials 6.6.2 NAT 1:1 Virtual Server This section sets up a virtual server rule that changes the destination of SMTP traffic coming to IP address 1.1.1.1 at the ZyWALL’s ge3 (WAN) interface, to the LAN SMTP server’s IP address (192.168.1.21). This is also called Destination NAT (DNAT) Figure 92 NAT 1:1 Example Virtual Server Destination 192.168.1.21 SMTP NAT Destination 1.1.1.1 SMTP 192.168.1.21 The ge3 WAN interface has a different IP address than 1.1.1.
Chapter 6 Tutorials Figure 94 NAT 1:1 Example Policy Route Source 1.1.1.1 Source 192.168.1.1 SMTP NAT SMTP 192.168.1.21 Click Network > Routing > Policy Route > Add and configure the screen as shown next. Be careful of where you create the route as routes are ordered in descending priority. Figure 95 Create a Policy Route 6.6.4 NAT 1:1 Firewall Rule Create a firewall rule to allow access from the WAN zone to the mail server in the LAN zone.
Chapter 6 Tutorials Figure 96 Create a Firewall Rule 6.7 NAT Loopback The NAT 1:1 example in Section 6.6 on page 147 maps a public IP address to the private IP address of a LAN SMTP mail server to allow users to access the SMTP mail server from the WAN. LAN users can also use an IP address to access the mail server. However, you need to configure NAT loopback for LAN users to use a domain name to access the server. Figure 97 LAN Computer Queries the DNS Server DNS xxx.LAN-SMTP.com = 1.1.1.1 xxx.LAN-SMTP.
Chapter 6 Tutorials 6.7.1 NAT Loopback Virtual Server When a LAN user sends SMTP traffic to IP address 1.1.1.1, the traffic comes into the ZyWALL through the ge1 (LAN) interface, thus it does not match the NAT 1:1 mapping’s virtual server rule for SMTP traffic coming to IP 1.1.1.1 from ge3 (the WAN). So you must configure a similar virtual server rule for ge1. Figure 98 NAT Loopback Virtual Server NAT Destination 192.168.1.21 1.1.1.1 Destination 1.1.1.1 SMTP SMTP LAN 192.168.1.21 192.168.1.
Chapter 6 Tutorials 6.7.2 NAT Loopback Policy Route Without a NAT loopback policy route, the LAN user SMTP traffic goes to the LAN SMTP server has the LAN computer’s IP address as the source. The source address is in the same subnet, so the LAN SMTP server replies directly. The return traffic uses the SMTP server’s LAN IP address as the source address1. This creates a triangle route since the source does not match the original destination address (1.1.1.1). The user’s computer shuts down the session.
Chapter 6 Tutorials Figure 102 Create a Policy Route Now the LAN SMTP server replies to the ZyWALL’s LAN IP address and the ZyWALL changes the source address to 1.1.1.1 before sending it to the LAN user’s computer. The source in the return traffic matches the original destination address (1.1.1.1) and the LAN user can use the LAN SMTP server. Figure 103 NAT Loopback Successful NAT Source 192.168.1.21 Source 1.1.1.1 SMTP SMTP LAN 192.168.1.21 154 192.168.1.
Chapter 6 Tutorials 6.8 Service Control and the Firewall Service control lets you configure rules that control HTTP and HTTPS management access (to the web configurator) and separate rules that control HTTP and HTTPS user access (logging into SSL VPN for example). See Chapter 43 on page 575 for more on service control. The To-ZyWALL firewall rules apply to any kind of HTTP or HTTPS connection to the ZyWALL. They do not distinguish between administrator management access and user access.
Chapter 6 Tutorials Figure 105 System > WWW > Service Control Rule Edit 4 Click Apply. Figure 106 System > WWW Now administrators can only log into the web configurator from the LAN zone. Non-admin users can still use HTTPS to log into the ZyWALL from any of the ZyWALL’s zones (to use SSL VPN for example).
CHAPTER 7 Status This chapter explains the Status screen, which is the screen you see when you first log in to the ZyWALL or when you click Status. 7.1 Status Screen Use this screen to look at the ZyWALL’s general device information, system status, system resource usage, licensed service status, and interface status.
Chapter 7 Status The following table describes the labels in this screen. Table 34 Status LABEL DESCRIPTION Device Information System Name This field displays the name used to identify the ZyWALL on any network. Click the icon on the right to open the screen where you can change it. See Section 43.2 on page 575. Model Name This field displays the model name of this ZyWALL. Serial Number This field displays the serial number of this ZyWALL.
Chapter 7 Status Table 34 Status (continued) LABEL DESCRIPTION Signature Version This field displays the version number, date, and time of the current set of signatures the ZyWALL is using. Last Update Time This field displays the last time the ZyWALL received updated signatures. Total Signature Number This field displays the total number of signatures in the current signature version.
Chapter 7 Status Table 34 Status (continued) LABEL DESCRIPTION HA Status This field displays the status of the interface in the virtual router. Active - This interface is the master interface in the virtual router. Stand-By - This interface is a backup interface in the virtual router. Fault - This VRRP group is not functioning in the virtual router right now. For example, this might happen if the interface is down. n/a - Device HA is not active on the interface.
Chapter 7 Status Figure 108 Status > VPN Status The following table describes the labels in this screen. Table 35 Status > VPN Status LABEL DESCRIPTION # This field is a sequential value, and it is not associated with a specific SA. Name This field displays the name of the IPSec SA. Encapsulation This field displays how the IPSec SA is encapsulated. IPSec Algorithm This field displays the encryption and authentication algorithms used in the SA.
Chapter 7 Status Figure 109 Status > DHCP Table The following table describes the labels in this screen. Table 36 Status > DHCP Table LABEL DESCRIPTION Interface Select for which interface you want to look at the IP addresses currently assigned to DHCP clients and the IP addresses reserved for specific MAC addresses. # This field is a sequential value, and it is not associated with a specific entry.
Chapter 7 Status Figure 110 Status > Port Statistics The following table describes the labels in this screen. Table 37 Status > Port Statistics LABEL DESCRIPTION Port This field displays the physical port number. status This field displays the current status of the physical port. Down - The physical port is not connected. Speed / Duplex - The physical port is connected. This field displays the port speed and duplex setting (Full or Half).
Chapter 7 Status Figure 111 Status > Current Users The following table describes the labels in this screen. Table 38 Status > Current Users 164 LABEL DESCRIPTION # This field is a sequential value and is not associated with any entry. User ID This field displays the user name of each user who is currently logged in to the ZyWALL. Reauth Lease T. This field displays the amount of reauthentication time remaining and the amount of lease time remaining for each user. See Chapter 34 on page 503.
CHAPTER 8 Registration This chapter shows you how to register for the ZyWALL’s subscription services. 8.1 myZyXEL.com Overview myZyXEL.com is ZyXEL’s online services center where you can register your ZyWALL and manage subscription services available for the ZyWALL. " You need to create an account before you can register your device and activate the services at myZyXEL.com. You can directly create a myZyXEL.com account, register your ZyWALL and activate a service using the Registration screen.
Chapter 8 Registration • SSL VPN tunnels provide secure network access to remote users. You can purchase and enter a license key to have the ZyWALL use more SSL VPN tunnels. • The content filter allows or blocks access to web sites. Subscribe to category-based content filtering to block access to categories of web sites based on content. Your ZyWALL accesses an external database that has millions of web sites categorized based on content.
Chapter 8 Registration The following table describes the labels in this screen. Table 39 Licensing > Registration LABEL DESCRIPTION General Setup If you select existing myZyXEL.com account, only the User Name and Password fields are available. new myZyXEL.com account If you haven’t created an account at myZyXEL.com, select this option and configure the following fields to create an account and register your ZyWALL. existing myZyXEL.com account If you already have an account at myZyXEL.
Chapter 8 Registration Figure 113 Licensing > Registration: Registered Device 8.3 Service After you activate a trial, you can also use this screen to register and enter your iCard’s PIN number (license key). Click Licensing > Registration > Service to open the screen as shown next. Figure 114 Licensing > Registration > Service The following table describes the labels in this screen.
Chapter 8 Registration Table 40 Licensing > Registration > Service (continued) LABEL DESCRIPTION Expiration date This field displays the date your service expires. You can continue to use IDP/AppPatrol or Anti-Virus after the registration expires, you just won’t receive updated signatures. Count This field displays how many VPN tunnels you can use with your current license. This field does not apply to the other services.
Chapter 8 Registration 170 ZyWALL USG 1000 User’s Guide
CHAPTER 9 Update This chapter shows you how to update the ZyWALL’s signature packages. 9.1 Updating Anti-virus Signatures When scheduling signature updates, choose a day and time when your network is least busy to minimize disruption to your network. Your custom signature configurations are not overwritten when you download new signatures. IDP signatures (see the chapters on IDP) are included with string-based anti-virus signatures.
Chapter 9 Update Figure 115 Licensing > Update >Anti-Virus The following table describes the labels in this screen. LABEL DESCRIPTION Signature Information Current Version Signature Number This field displays the number of signatures in this set. Released Date This field displays the date and time the set was released. Remote Update 172 This field displays the signatures version number currently used by the ZyWALL.
Chapter 9 Update 9.2 Updating IDP and Application Patrol Signatures The ZyWALL comes with signatures for the IDP and application patrol features. These signatures are continually updated as new attack types evolve. New signatures can be downloaded to the ZyWALL periodically if you have subscribed for IDP service. You need to create an account at myZyXEL.com, register your ZyWALL and then subscribe for IDP service in order to be able to download new packet inspection signatures from myZyXEL.
Chapter 9 Update Table 41 Licensing > Update > IDP/AppPatrol (continued) LABEL DESCRIPTION Auto Update Select this check box to have the ZyWALL automatically check for new IDP signatures regularly at the time and day specified. You should select a time when your network is not busy for minimal interruption. Hourly Select this option to have the ZyWALL check for new IDP signatures every hour. Daily Select this option to have the ZyWALL check for new IDP signatures everyday at the specified time.
Chapter 9 Update 9.3 Updating System Protect Signatures The ZyWALL comes with signatures that the ZyWALL uses to protect itself from intrusions. These signatures are continually updated as new attack types evolve. These system protect signature updates are free and can be downloaded to the ZyWALL periodically. Click Licensing > Update > System Protect to display the following screen. Use this screen to schedule or immediately download IDP signatures.
Chapter 9 Update Table 42 Licensing > Update > System Protect (continued) LABEL DESCRIPTION Daily Select this option to have the ZyWALL check for new signatures every day at the specified time. The time format is the 24 hour clock, so ‘23’ means 11PM for example. Weekly Select this option to have the ZyWALL check for new signatures once a week on the day and at the time specified. Apply Click this button to save your changes to the ZyWALL.
P ART II Network Interface (179) Trunks (219) Policy and Static Routes (225) Routing Protocols (235) Zones (245) DDNS (249) Virtual Servers (255) HTTP Redirect (261) ALG (265) 177
CHAPTER 10 Interface See Section 5.4.2 on page 115 for related information on these screens. 10.1 Interface Overview In general, an interface has the following characteristics. • • • • • • An interface is a logical entity through which (layer-3) packets pass. An interface is bound to a physical port or another interface. Many interfaces can share the same physical port. An interface is bound to at most one zone. Many interface can belong to the same zone.
Chapter 10 Interface • Trunks manage load balancing between interfaces. Port groups, trunks, and the auxiliary interface have a lot of characteristics that are specific to each type of interface. They are discussed in more detail in Section 10.3.1 on page 194, Chapter 11 on page 219, and Section 10.7.1 on page 215, respectively. The other types of interfaces--Ethernet, VLAN, bridge, PPPoE/PPTP, and virtual--have a lot of similar characteristics.
Chapter 10 Interface Figure 122 Example: Entry in the Routing Table Derived from Interfaces Table 44 Example: Routing Table Entries for Interfaces IP ADDRESS(ES) DESTINATION 100.100.1.1/16 ge1 200.200.200.1/24 ge2 For example, if the ZyWALL gets a packet with a destination address of 100.100.25.25, it routes the packet to interface ge1. If the ZyWALL gets a packet with a destination address of 200.200.200.200, it routes the packet to interface ge2.
Chapter 10 Interface 10.1.3 Interface Parameters The ZyWALL restricts the amount of traffic into and out of the ZyWALL through each interface. • Upstream bandwidth is the amount of traffic from the ZyWALL through the interface to the network. • Downstream bandwidth is the amount of traffic from the network through the interface into the ZyWALL.2 If you set the bandwidth restrictions very high, you effectively remove the restrictions. The ZyWALL also restricts the size of each data packet.
Chapter 10 Interface Table 46 Example: Assigning IP Addresses from a Pool (continued) START IP ADDRESS POOL SIZE RANGE OF ASSIGNED IP ADDRESS 99.99.1.1 1023 99.99.1.1 - 99.99.4.255 120.120.120.100 100 120.120.120.100 - 120.120.120.199 The ZyWALL cannot assign the first address (network address) or the last address (broadcast address) in the subnet defined by the interface’s IP address and subnet mask. For example, in the first entry, if the subnet mask is 255.255.255.0, the ZyWALL cannot assign 50.
Chapter 10 Interface 10.1.6 Relationships Between Interfaces In the ZyWALL, interfaces are usually created on top of other interfaces. Only Ethernet interfaces are created directly on top of the physical ports (or port groups). The relationships between interfaces are explained in the following table.
Chapter 10 Interface In addition, you use Ethernet interfaces to control which physical ports exchange routing information with other routers and how much information is exchanged through each one. The more routing information is exchanged, the more efficient the routers should be. However, the routers also generate more network traffic, and some routing protocols require a significant amount of configuration and management. The ZyWALL supports two routing protocols, RIP and OSPF.
Chapter 10 Interface Figure 123 Network > Interface > Interface Summary Each field is described in the following table. Table 48 Network > Interface > Interface Summary 186 LABEL DESCRIPTION Interface Summary If an Ethernet interface does not have any physical ports associated with it, its entry is displayed in light gray text. Name This field displays the name of each interface.
Chapter 10 Interface Table 48 Network > Interface > Interface Summary (continued) LABEL DESCRIPTION Status This field displays the current status of each interface. The possible values depend on what type of interface it is. For port groups: Inactive - The port group is disabled. Port Group Down - The port group is enabled but not connected. Port Group Up - The port group is enabled, and at least one of the physical ports associated with it is connected.
Chapter 10 Interface Table 48 Network > Interface > Interface Summary (continued) LABEL DESCRIPTION Interface Statistics This table provides packet statistics for each interface. Name This field displays the name of each interface. If there is a Expand icon (plus-sign) next to the name, click this to look at the statistics for virtual interfaces on top of this interface. Status This field displays the current status of the interface. Down - The interface is not connected.
Chapter 10 Interface Each field is described in the following table. Table 49 Network > Interface > Ethernet LABEL DESCRIPTION # This field is a sequential value, and it is not associated with any interface. Name This field displays the name of the interface. IP Address This field displays the current IP address of the interface. If the IP address is 0.0.0.0, the interface does not have an IP address yet.
Chapter 10 Interface Figure 125 Network > Interface > Ethernet > Edit 190 ZyWALL USG 1000 User’s Guide
Chapter 10 Interface Each field is described in the table below. Table 50 Network > Interface > Ethernet > Edit LABEL DESCRIPTION Ethernet Interface Properties Enable Select this to enable this interface. Clear this to disable this interface. Interface Name This field is read-only. This is the name of the Ethernet interface. Description Enter a description of this interface. It is not used elsewhere. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long.
Chapter 10 Interface Table 50 Network > Interface > Ethernet > Edit (continued) LABEL DESCRIPTION Direction This field is effective when RIP is enabled. Select the RIP direction from the drop-down list box. BiDir - This interface sends and receives routing information. In-Only - This interface receives routing information. Out-Only - This interface sends routing information. Send Version This field is effective when RIP is enabled. Select the RIP version(s) used for sending RIP packets.
Chapter 10 Interface Table 50 Network > Interface > Ethernet > Edit (continued) LABEL Relay Server 2 DESCRIPTION This field is optional. Enter the IP address of another DHCP server for the network. These fields appear if the ZyWALL is a DHCP Server. IP Pool Start Address Enter the IP address from which the ZyWALL begins allocating IP addresses. If you want to assign a static IP address to a specific computer, click Add Static DHCP. If this field is blank, the Pool Size must also be blank.
Chapter 10 Interface Table 50 Network > Interface > Ethernet > Edit (continued) LABEL Edit static DHCP table DESCRIPTION Click this if you want the ZyWALL to assign static IP addresses to computers. The Static DHCP screen appears. Figure 126 Network > Interface > Ethernet > Edit > Edit static DHCP table The ZyWALL checks this table when it assigns IP addresses. If the computer’s MAC address is in the table, the ZyWALL assigns the corresponding IP address.
Chapter 10 Interface Each physical port is assigned to one Ethernet interface. In port grouping, the Ethernet interfaces are called representative interfaces. If you assign more than one physical port to a representative interface, you create a port group. Port groups have the following characteristics: • There is a layer-2 Ethernet switch between physical ports in the port group. This provides wire-speed throughput but no security.
Chapter 10 Interface Figure 129 Network > Interface > Port Grouping Each section in this screen is described below. Table 51 Network > Interface > Port Grouping LABEL DESCRIPTION Representative Interface (ge1, ge2, ge3, ge4, ge5) These are Ethernet interfaces. To add a physical port to a representative interface, drag the physical port onto the corresponding representative interface. Physical Port (1, 2, 3, 4, 5) These are the physical ports as they appear on the front panel of the ZyWALL.
Chapter 10 Interface Figure 130 Example: Before VLAN A B C In this example, there are two physical networks and three departments A, B, and C. The physical networks are connected to hubs, and the hubs are connected to the router. Alternatively, you can divide the physical networks into three VLANs. Figure 131 Example: After VLAN A B Each VLAN is a separate network with separate IP addresses, subnet masks, and gateways. Each VLAN also has a unique identification number (ID).
Chapter 10 Interface • Better manageability - You can align network policies more appropriately for users. For example, you can create different content filtering rules for each VLAN (each department in the example above), and you can set different bandwidth limits for each VLAN. These rules are also independent of the physical network, so you can change the physical network without changing policies. In this example, the new switch handles the following types of traffic: • • • • Inside VLAN 2.
Chapter 10 Interface Table 52 Network > Interface > VLAN (continued) LABEL DESCRIPTION Port/VID For VLAN interfaces, this field displays • the Ethernet interface on which the VLAN interface is created • the VLAN ID For virtual interfaces, this field is blank. IP Address This field displays the current IP address of the interface. If the IP address is 0.0.0.0, the interface does not have an IP address yet.
Chapter 10 Interface Figure 133 Network > Interface > VLAN > Edit 200 ZyWALL USG 1000 User’s Guide
Chapter 10 Interface Each field is explained in the following table. Table 53 Network > Interface > VLAN > Edit LABEL DESCRIPTION VLAN Interface Properties Enable Select this to enable this interface. Clear this to disable this interface. Interface Name This field is read-only if you are editing the interface. Enter the name of the VLAN interface. The format is vlanx, where x is 0 - 31. For example, vlan0, vlan8, and so on. Port Select the Ethernet interface on which the VLAN interface runs.
Chapter 10 Interface Table 53 Network > Interface > VLAN > Edit (continued) LABEL DHCP DESCRIPTION Select what type of DHCP service the ZyWALL provides to the network. Choices are: None - the ZyWALL does not provide any DHCP services. There is already a DHCP server on the network. DHCP Relay - the ZyWALL routes DHCP requests to one or more DHCP servers you specify. The DHCP server(s) may be on another network.
Chapter 10 Interface Table 53 Network > Interface > VLAN > Edit (continued) LABEL Edit static DHCP table DESCRIPTION Click this if you want the ZyWALL to assign static IP addresses to computers. The Static DHCP screen appears. Figure 134 Network > Interface > Edit > Edit static DHCP table The ZyWALL checks this table when it assigns IP addresses. If the computer’s MAC address is in the table, the ZyWALL assigns the corresponding IP address.
Chapter 10 Interface 10.5.1 Bridge Overview A bridge creates a connection between two or more network segments at the layer-2 (MAC address) level. In the following example, bridge X connects four network segments. When the bridge receives a packet, the bridge records the source MAC address and the port on which it was received in a table. It also looks up the destination MAC address in the table. If the bridge knows on which port the destination MAC address is located, it sends the packet to that port.
Chapter 10 Interface 10.5.2 Bridge Interface Overview A bridge interface creates a software bridge between the members of the bridge interface. It also becomes the ZyWALL’s interface for the resulting network.
Chapter 10 Interface Table 57 Network > Interface > Bridge (continued) LABEL DESCRIPTION IP Address This field displays the current IP address of the interface. If the IP address is 0.0.0.0, the interface does not have an IP address yet. This screen also shows whether the IP address is a static IP address (STATIC) or dynamically assigned (DHCP). IP addresses are always static in virtual interfaces. Member This field displays the Ethernet interfaces and VLAN interfaces in the bridge interface.
Chapter 10 Interface Figure 136 Network > Interface > Bridge > Edit ZyWALL USG 1000 User’s Guide 207
Chapter 10 Interface In this example, you are creating a new bridge. If you are editing a bridge, the Interface Name field is read-only. Each field is described in the table below. Table 58 Network > Interface > Bridge > Edit LABEL DESCRIPTION Bridge Interface Properties Enable Select this to enable this interface. Clear this to disable this interface. Interface Name This field is read-only if you are editing the interface. Enter the name of the bridge interface. The format is brx, where x is 0 - 11.
Chapter 10 Interface Table 58 Network > Interface > Bridge > Edit (continued) LABEL MTU DESCRIPTION Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can move through this interface. If a larger packet arrives, the ZyWALL divides it into smaller fragments. Allowed values are 576 - 1500. Usually, this value is 1500. DHCP Settings DHCP Select what type of DHCP service the ZyWALL provides to the network. Choices are: None - the ZyWALL does not provide any DHCP services.
Chapter 10 Interface Table 58 Network > Interface > Bridge > Edit (continued) LABEL Edit static DHCP table DESCRIPTION Click this if you want the ZyWALL to assign static IP addresses to computers. The Static DHCP screen appears. Figure 137 Network > Interface > Edit > Edit static DHCP table The ZyWALL checks this table when it assigns IP addresses. If the computer’s MAC address is in the table, the ZyWALL assigns the corresponding IP address.
Chapter 10 Interface PPPoE is often used with cable modems and DSL connections. It provides the following advantages: • The access and authentication method works with existing systems, including RADIUS. • You can access one of several network services. This makes it easier for the service provider to offer the service • PPPoE does not usually require any special configuration of the modem. PPTP is used to set up virtual private networks (VPN) in unsecure TCP/IP environments. It sets up two sessions.
Chapter 10 Interface 10.6.3 PPPoE/PPTP Interface Summary " You have to set up an ISP account before you create a PPPoE/PPTP interface. This screen lists every PPPoE/PPTP interface. To access this screen, click Network > Interface > PPPoE/PPTP. Figure 139 Network > Interface > PPPoE/PPTP Each field is described in the table below. Table 59 Network > Interface > PPPoE/PPTP 212 LABEL DESCRIPTION # This field is a sequential value, and it is not associated with any interface.
Chapter 10 Interface 10.6.4 PPPoE/PPTP Interface Add/Edit " You have to set up an ISP account before you create a PPPoE/PPTP interface. This screen lets you configure new or existing PPPoE/PPTP interfaces. To access this screen, click the Add icon or an Edit icon in the PPPoE/PPTP Interface Summary screen.
Chapter 10 Interface Each field is explained in the following table. Table 60 Network > Interface > PPPoE/PPTP > Edit LABEL DESCRIPTION PPP Interface Properties Enable Select this to enable this interface. Clear this to disable this interface. Interface Name This field is read-only if you are editing the interface. Enter the name of the bridge interface. The format is pppx, where x is 0 - 11. For example, ppp0, ppp7, and so on. Nail_Up Select this if the PPPoE/PPTP connection should always be up.
Chapter 10 Interface Table 60 Network > Interface > PPPoE/PPTP > Edit (continued) LABEL DESCRIPTION Ping Check The interface can regularly ping the gateway you specified to make sure it is still available. You specify how often the interface pings the gateway, how long to wait for a response before the attempt is a failure, and how many consecutive failures are required before the ZyWALL stops routing to the gateway.
Chapter 10 Interface Figure 141 Network > Interface > Auxiliary Each field is described in the table below. Table 61 Network > Interface > Auxiliary LABEL DESCRIPTION Auxiliary Interface Properties Enable Select this to turn on the auxiliary dial up interface. The interface does not dial out, however, unless it is part of a trunk and load-balancing conditions are satisfied. Description Enter a description of this interface. It is not used elsewhere.
Chapter 10 Interface Table 61 Network > Interface > Auxiliary (continued) LABEL DESCRIPTION Authentication Type Select the authentication protocol to use for outgoing calls. Choices are: CHAP/PAP - Your ZyWALL accepts either CHAP or PAP, as requested by the computer you are dialing. CHAP - Your ZyWALL accepts CHAP only. PAP - Your ZyWALL accepts PAP only. MSCHAP - Your ZyWALL accepts MSCHAP only. MSCHAP-V2 - Your ZyWALL accepts MSCHAP-V2 only.
Chapter 10 Interface Figure 142 Network > Interface > Add Each field is described in the table below. Table 62 Network > Interface > Add LABEL DESCRIPTION Virtual Interface Properties Interface Name This field is read-only. It displays the name of the virtual interface, which is automatically derived from the underlying Ethernet interface, VLAN interface, or bridge interface. Description Enter a description of this interface. It is not used elsewhere.
CHAPTER 11 Trunks This chapter shows you how to configure trunks on your ZyWALL. See Section 5.4.3 on page 115 for related information on these screens. 11.1 Trunks Overview You can group multiple interfaces together into trunks to have multiple connections share the traffic load to increase overall network throughput and enhance network reliability. If one interface’s connection goes down, the ZyWALL sends traffic through another member of the trunk.
Chapter 11 Trunks Maybe you have two connections with different bandwidths. For jitter-sensitive traffic (like video for example), you could set up a trunk group that uses spillover or weighted round robin load balancing to make sure that most of the jitter-sensitive traffic goes through the higherbandwidth interface. For some traffic connections, you might want to use least load first load balancing in order to even out the distribution of the traffic load. 11.
Chapter 11 Trunks 11.4.2 Weighted Round Robin Round Robin scheduling services queues on a rotating basis and is activated only when an interface has more traffic than it can handle. A queue is given an amount of bandwidth irrespective of the incoming traffic on that interface. This queue then moves to the back of the list. The next queue is given an equal amount of bandwidth, and then moves to the end of the list; and so on, depending on the number of queues being used.
Chapter 11 Trunks Figure 145 Spillover Algorithm Example 11.5 Trunk Summary Click Network > Interface > Trunk to open the Trunk screen. This screen lists the configured trunks and the load balancing algorithm that each is configured to use. Figure 146 Network > Interface > Trunk The following table describes the items in this screen. Table 64 Network > Interface > Trunk LABEL DESCRIPTION Name This field displays the label that you specified to identify the trunk.
Chapter 11 Trunks Figure 147 Network > Interface > Trunk > Edit Each field is described in the table below. Table 65 Network > Interface > Trunk > Edit LABEL DESCRIPTION Name Enter a descriptive name for this trunk. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Load Balancing Algorithm Select a load balancing method to use from the drop-down list box.
Chapter 11 Trunks Table 65 Network > Interface > Trunk > Edit (continued) 224 LABEL DESCRIPTION Spillover This field displays with the spillover load balancing algorithm. Specify the maximum bandwidth of traffic in kilobits per second (1~1048576) to send out through the interface before using another interface. When this spillover bandwidth limit is exceeded, the ZyWALL sends new session traffic through the next interface.
CHAPTER 12 Policy and Static Routes This chapter shows you how to configure policies for IP routing and static routes on your ZyWALL. See Section 5.4.10 on page 117 for related information on the policy route screens. 12.1 Policy Route Traditionally, routing is based on the destination address only and the ZyWALL takes the shortest path to forward a packet.
Chapter 12 Policy and Static Routes IPPR follows the existing packet filtering facility of RAS in style and in implementation. 12.2.1 NAT and SNAT NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address in a packet in one network to a different IP address in another network. Use SNAT (Source NAT) to change the source IP address in one network to a different IP address in another network. 12.2.
Chapter 12 Policy and Static Routes Figure 148 Trigger Port Forwarding Example 12.2.3 Maximize Bandwidth Usage The maximize bandwidth usage option allows the ZyWALL to divide up any available bandwidth on the interface (including unallocated bandwidth and any allocated bandwidth that a policy route is not using) among the policy routes that require more bandwidth. When you enable maximize bandwidth usage, the ZyWALL first makes sure that each policy route gets up to its bandwidth allotment.
Chapter 12 Policy and Static Routes Figure 149 Network > Routing > Policy Route The following table describes the labels in this screen. Table 66 Network > Routing > Policy Route 228 LABEL DESCRIPTION Enable BWM This is a global setting for enabling or disabling bandwidth management on the ZyWALL. You must enable this setting to have individual policy routes or application patrol policies apply bandwidth management. This same setting also appears in the AppPatrol > General screen.
Chapter 12 Policy and Static Routes Table 66 Network > Routing > Policy Route (continued) LABEL DESCRIPTION Add icon Click the Add icon in the heading row to add a new first entry. The Active icon displays whether the rule is enabled or not. Click the Active icon to activate or deactivate the policy. Make sure you click Apply to save and apply the change. Click the Edit icon to go to the screen where you can edit the routing policy on the ZyWALL.
Chapter 12 Policy and Static Routes Figure 150 Network > Routing > Policy Route > Edit The following table describes the labels in this screen. Table 67 Network > Routing > Policy Route > Edit LABEL DESCRIPTION Configuration Enable Select this to activate the policy. Description Enter a descriptive name of up to 31 printable ASCII characters for the policy. Criteria User Select a user name or user group from which the packets are sent.
Chapter 12 Policy and Static Routes Table 67 Network > Routing > Policy Route > Edit (continued) LABEL DESCRIPTION Type Select Auto to have the ZyWALL use the routing table to find a next-hop and forward the matched packets automatically. Select Gateway to route the matched packets to the next-hop router or switch you specified in the Gateway field. You have to set up the next-hop router or switch as a HOST address object first. Select VPN Tunnel to route the matched packets via the specified VPN tunnel.
Chapter 12 Policy and Static Routes Table 67 Network > Routing > Policy Route > Edit (continued) LABEL DESCRIPTION Bandwidth Shaping This allows you to allocate bandwidth to a route and prioritize traffic that matches the routing policy. You must also enable bandwidth management in the main policy route screen (Network > Routing > Policy Route) in order to apply bandwidth shaping. Maximum Bandwidth Specify the maximum bandwidth (from 1 to 1048576) allowed for the route in kbps.
Chapter 12 Policy and Static Routes 12.6 Static Route Summary Click Network > Routing > Static Route to open the Static Route screen. Figure 152 Network > Routing > Static Route The following table describes the labels in this screen. Table 68 Network > Routing > Static Route LABEL DESCRIPTION # This is the number of an individual static route. Destination This is the destination IP address. Subnet Mask This is the IP subnet mask.
Chapter 12 Policy and Static Routes The following table describes the labels in this screen. Table 69 Network > Routing > Static Route > Edit 234 LABEL DESCRIPTION Destination IP This parameter specifies the IP network address of the final destination. Routing is always based on network number. If you need to specify a route to a single host, use a subnet mask of 255.255.255.255 in the subnet mask field to force the network number to be identical to the host ID.
CHAPTER 13 Routing Protocols This chapter describes how to set up RIP and OSPF routing protocol settings for the ZyWALL. First, it provides an overview of RIP and OSPF, and, then, it introduces the RIP and OSPF screens used to configure routing protocols. See Section 5.5 on page 122 for related information on these screens. 13.1 Routing Protocols Overview Routing protocols give the ZyWALL routing information about the network from other routers.
Chapter 13 Routing Protocols RIP uses UDP port 520. 13.1.2 Authentication Types Authentication is used to guarantee the integrity, but not the confidentiality, of routing updates. The transmitting router uses its key to encrypt the original message into a smaller message, and the smaller message is transmitted with the original message. The receiving router uses its key to encrypt the received message and then verifies that it matches the smaller message sent with it.
Chapter 13 Routing Protocols Figure 154 Network > Routing > RIP The following table describes the labels in this screen. Table 71 Network > Routing Protocol > RIP LABEL DESCRIPTION Authentication Authentication Select the authentication method used in the RIP network. Choices are: None, Text, and MD5. Text Authentication Key This field is available if the Authentication is Text. Type the password for text authentication.
Chapter 13 Routing Protocols • OSPF filters and summarizes routing information, which reduces the size of routing tables throughout the network. • OSPF responds to changes in the network, such as the loss of a router, more quickly. • OSPF considers several factors, including bandwidth, hop count, throughput, round trip time, and reliability, when it calculates the shortest path. • OSPF converges more quickly than RIP.
Chapter 13 Routing Protocols This OSPF AS consists of four areas, areas 0-3. Area 0 is always the backbone. In this example, areas 1, 2, and 3 are all connected to it. Area 1 is a normal area. It has routing information about the OSPF AS and networks X and Y. Area 2 is a stub area. It has routing information about the OSPF AS, but it depends on a default route to send information to networks X and Y. Area 3 is a NSSA. It has routing information about the OSPF AS and network Y but not about network X. 13.
Chapter 13 Routing Protocols Figure 156 OSPF: Types of Routers In order to reduce the amount of traffic between routers, a group of routers that are directly connected to each other selects a designated router (DR) and a backup designated router (BDR). All of the routers only exchange information with the DR and the BDR, instead of exchanging information with all of the other routers in the group. The DR and BDR are selected by priority; if two routers have the same priority, the highest router ID is used.
Chapter 13 Routing Protocols 2 Set up the OSPF areas. 3 Configure the appropriate interfaces. See Section 10.2.1 on page 184. 4 Set up virtual links, as needed. 13.4 OSPF Screens The OSPF screens are used to specify the ID the ZyWALL uses in the OSPF AS and to maintain the policies for redistribution. In addition, they are also used to create, maintain, and remove OSPF areas. 13.4.1 OSPF Summary The OSPF screen is used to specify the OSPF router and maintain the policies for redistribution.
Chapter 13 Routing Protocols Table 73 Network > Routing Protocol > OSPF (continued) LABEL DESCRIPTION Active Select this check box to advertise routes that were learned from the indicated source. • If you select this for RIP, the ZyWALL advertises routes learned from RIP to Normal and NSSA areas but not to Stub areas. • If you select this for static routes, the ZyWALL advertises routes learned from static routes to all types of areas.
Chapter 13 Routing Protocols Figure 159 Network > Routing > OSPF > Edit The following table describes the labels in this screen. Table 74 Network > Routing > OSPF > Edit LABEL DESCRIPTION Area ID Type the unique, 32-bit identifier for the area in IP address format. Type This field displays the type of area. Normal - This area is a normal area. It has routing information about the OSPF AS and about networks outside the OSPF AS. Stub - This area is an stub area.
Chapter 13 Routing Protocols Table 74 Network > Routing > OSPF > Edit (continued) 244 LABEL DESCRIPTION Text Authentication Key This field is available if the Authentication is Text. Type the password for text authentication. The key can consist of alphanumeric characters and the underscore, and it can be up to 8 characters long. MD5 Authentication ID This field is available if the Authentication is MD5. Type the default ID for MD5 authentication in the area. The ID can be between 1 and 255.
CHAPTER 14 Zones Set up zones to configure network security and network policies in the ZyWALL. See Section 5.4.7 on page 116 for related information on these screens. 14.1 Zones Overview A zone is a group of interfaces and VPN tunnels. The ZyWALL uses zones, not interfaces, in many security and policy settings, such as firewall rules and remote management. Zones cannot overlap.
Chapter 14 Zones Intra-zone traffic is traffic between interfaces or VPN tunnels in the same zone. For example, in Figure 160 on page 245, traffic between VLAN 2 and the Ethernet is intra-zone traffic. In each zone, you can either allow or prohibit all intra-zone traffic. For example, in Figure 160 on page 245, you might allow intra-zone traffic in the LAN2 zone but prohibit it in the WAN zone.
Chapter 14 Zones 14.3 Zone Add/Edit The Zone Add/Edit screen allows you to define a zone or edit an existing one. To access this screen, go to the Zone screen (see Section 14.2 on page 246), and click either the Add icon or an Edit icon. Figure 162 Network > Zone > Edit The following table describes the labels in this screen. Table 76 Network > Zone > Edit LABEL DESCRIPTION Name Type the name used to refer to the zone.
Chapter 14 Zones 248 ZyWALL USG 1000 User’s Guide
CHAPTER 15 DDNS This chapter describes how to configure dynamic DNS (DDNS) services for the ZyWALL. First, it provides an overview, and then it introduces the screens. See Section 5.4.9 on page 117 for related information on these screens. 15.1 DDNS Overview DNS maps a domain name to a corresponding IP address and vice versa. Similarly, dynamic DNS maps a domain name to a dynamic IP address. As a result, anyone can use the domain name to contact you (in NetMeeting, CU-SeeMe, etc.
Chapter 15 DDNS 15.1.2 High Availability (HA) The DDNS server maps a domain name to the IP address of one of the ZyWALL’s WAN ports. If that WAN port loses its connection, high availability allows the ZyWALL to substitute the HA port’s IP address in the domain name mapping. 15.1.3 Mail Exchanger DynDNS can route e-mail for your domain name to a specified mail server. The server is called a mail exchanger. For example, if there is e-mail for john-doe@yourhost.dyndns.
Chapter 15 DDNS 15.3 DDNS Summary The DDNS screen provides a summary of all DDNS domain names and their configuration. In addition, this screen allows you to add new domain names, edit the configuration for existing domain names, and delete domain names. To access this screen, login to the web configurator. When the main screen appears, click Network > DDNS. The following screen appears, providing a summary of the existing domain names.
Chapter 15 DDNS 15.4 Dynamic DNS Add/Edit The DDNS Add/Edit screen allows you to add a domain name to the ZyWALL or to edit the configuration of an existing domain name. To access this screen, click Network > DDNS, and click either the Add icon or an Edit icon. Figure 164 Network > DDNS > Edit The following table describes the labels in this screen. Table 78 Network > DDNS > Edit 252 LABEL DESCRIPTION Profile Name Type a descriptive name for this DDNS entry in the ZyWALL.
Chapter 15 DDNS Table 78 Network > DDNS > Edit (continued) LABEL DESCRIPTION HA Interface This field is only available when the IP Address Update Policy is Interface. Select the alternative WAN interface to map to the domain name when the WAN interface is not available. If you do not want to use HA, select none. Custom IP This field is only available when the IP Address Update Policy is Custom. Type the IP address to use for the domain name.
Chapter 15 DDNS 254 ZyWALL USG 1000 User’s Guide
CHAPTER 16 Virtual Servers This chapter describes how to set up, manage, and remove virtual servers. First, it provides an overview of virtual servers, and, then, it introduces the virtual server screens and commands. See Section 5.4.18 on page 121 for related information on these screens. 16.1 Virtual Server Overview Virtual server is also known as port forwarding or port translation. " The virtual server changes the destination address of packets. This is also known as Destination NAT (DNAT).
Chapter 16 Virtual Servers The ZyWALL checks virtual servers before it applies to-ZyWALL firewall rules, so toZyWALL firewall rules do not apply to traffic that is forwarded by virtual servers. The ZyWALL still checks regular (through-ZyWALL) firewall rules according to the source IP address and mapped IP address. Some common port numbers are listed in Appendix C on page 703. 16.
Chapter 16 Virtual Servers Figure 166 Network > Virtual Server The following table describes the labels in this screen. See Section 16.4.1 on page 258 below for more information as well. Table 79 Network > Virtual Server LABEL DESCRIPTION Total Virtual Servers This is how many virtual server entries are configured in the ZyWALL. entries per page Select how many virtual server entries to display per page in the screen.
Chapter 16 Virtual Servers 16.4.1 Virtual Server Add/Edit The Virtual Server Add/Edit screen lets you create new virtual servers and edit existing ones. To open this window, open the Virtual Server summary screen. (See Section 16.4 on page 256.) Then, click on an Add icon or Edit icon to open the following screen. " If the virtual server will send traffic to the clients, you need to create a corresponding policy route. This is called NAT 1:1. See Section 6.6 on page 147 for an example of NAT 1:1.
Chapter 16 Virtual Servers Table 80 Network > Virtual Server > Edit (continued) LABEL DESCRIPTION User Defined This field is available if Original IP is User Defined. Type the destination IP address that this virtual server supports. Mapped IP Type the translated destination IP address, if this virtual server forwards the packet. Mapping Type Use the drop-down list box to select how many original destination ports this virtual server supports for the selected destination IP address (Original IP).
Chapter 16 Virtual Servers 260 ZyWALL USG 1000 User’s Guide
CHAPTER 17 HTTP Redirect This chapter shows you how to configure HTTP redirection on your ZyWALL. See Section 5.4.19 on page 121 for related information on these screens. 17.1 HTTP Redirect Overview HTTP redirect forwards the client’s HTTP request (except HTTP traffic destined for the ZyWALL) to a web proxy server. 17.1.1 Web Proxy Server A proxy server helps client devices make indirect requests to access the Internet or outside network resources/services.
Chapter 17 HTTP Redirect Figure 168 HTTP Redirect Example In the example, proxy server A is connected to ge4 in the DMZ zone. When a client connected to ge1 wants to open a web page, its HTTP request is redirected to proxy server A first. If proxy server A cannot find the web page in its cache, a policy route allows it to access the Internet to get them from a server. Proxy server A then forwards the response to the client. To make this example work, make sure you have the following settings.
Chapter 17 HTTP Redirect Figure 169 Network > HTTP Redirect The following table describes the labels in this screen. Table 81 Network > HTTP Redirect LABEL DESCRIPTION Name This is the descriptive name (up to 31 printable characters) of a rule. Interface This is the interface on which the request must be received. Proxy Server This is the IP address of the proxy server. Port This is the service port number used by the proxy server.
Chapter 17 HTTP Redirect Table 82 Network > HTTP Redirect > Edit (continued) 264 LABEL DESCRIPTION Interface Select the interface on which the HTTP request must be received for the ZyWALL to forward it to the specified proxy server. Proxy Server Enter the IP address of the proxy server. Port Enter the port number that the proxy server uses. OK Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving.
CHAPTER 18 ALG This chapter covers how to use the ZyWALL’s ALG feature to allow certain applications to pass through the ZyWALL. See Section 5.4.20 on page 122 for related information on these screens. 18.1 ALG Introduction The ZyWALL can function as an Application Layer Gateway (ALG) to allow certain NAT unfriendly applications (such as SIP) to operate properly through the ZyWALL’s NAT.
Chapter 18 ALG You could also have a trunk with one interface set to active and a second interface set to passive. The ZyWALL does not automatically change ALG-managed connections to the second (passive) interface when the active interface’s connection goes down. When the active interface’s connection fails, the client needs to re-initialize the connection through the second interface (that was set to passive) in order to have the connection go through the second interface.
Chapter 18 ALG Figure 171 H.323 ALG Example 18.1.6 SIP The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol that handles the setting up, altering and tearing down of voice and multimedia sessions over the Internet. SIP is used in VoIP (Voice over IP), the sending of voice signals over the Internet Protocol. SIP signaling is separate from the media for which it handles sessions.
Chapter 18 ALG 18.1.6.2 SIP Signaling Session Timeout Most SIP clients have an “expire” mechanism indicating the lifetime of signaling sessions. The SIP user agent sends registration packets to the SIP server periodically and keeps the session alive in the ZyWALL. If the SIP client does not have this mechanism and makes no calls during the ZyWALL SIP timeout, the ZyWALL SIP ALG deletes the signaling session after the timeout period. 18.
Chapter 18 ALG For example, you configure firewall and virtual server rules to allow LAN IP address A to receive calls through public WAN IP address 1. You configure different firewall and port forwarding rules to allow LAN IP address B to receive calls through public WAN IP address 2. You configure corresponding policy routes to have calls from LAN IP address A go out through WAN IP address 1 and calls from LAN IP address B go out through WAN IP address 2.
Chapter 18 ALG The following table describes the labels in this screen. Table 83 Network > ALG 270 LABEL DESCRIPTION Enable SIP Transformations SIP is a signaling protocol used in VoIP (Voice over IP), the sending of voice signals over Internet Protocol. Turn on the SIP ALG to allow SIP sessions to pass through the ZyWALL. Using the SIP ALG allows you to use bandwidth management on SIP traffic. SIP Signaling Port If you are using a custom UDP port number (not 5060) for SIP traffic, enter it here.
Chapter 18 ALG 18.4 WAN to LAN SIP Peer-to-peer Calls Example This example shows how to configure firewall and virtual server (port forwarding) rules to allow H.323 calls to come in through WAN IP address 10.0.0.8 to computer A at IP address 192.168.1.56 on the LAN. Figure 176 WAN to LAN H.323 Peer-to-peer Calls Example Configure the virtual server policy first to forward H.323 (TCP port 1720) traffic received on the ZyWALL’s 10.0.0.8 WAN IP address to LAN IP address 192.168.1.56.
Chapter 18 ALG Figure 178 Firewall > WAN to LAN 5 Configure the screen as follows. For the Destination, select Create Object. Figure 179 Firewall > WAN > LAN > Add 6 Configure an address object for the ZyWALL’s 10.0.0.8 WAN IP address as follows and click OK. Figure 180 Object > Address > Add 7 Finish configuring the screen as follows and click OK.
Chapter 18 ALG Figure 181 Firewall > WAN > LAN > Add ZyWALL USG 1000 User’s Guide 273
Chapter 18 ALG 274 ZyWALL USG 1000 User’s Guide
P ART III Firewall and VPN Firewall (277) IPSec VPN (291) SSL VPN (323) SSL User Screens (331) SSL User Application Screens (337) SSL User File Sharing Screens (339) L2TP VPN (345) L2TP VPN Example (351) 275
CHAPTER 19 Firewall This chapter introduces the ZyWALL’s firewall and shows you how to configure your ZyWALL’s firewall. See Section 5.4.12 on page 118 for related information on these screens. 19.1 Firewall Overview The ZyWALL’s firewall is a stateful inspection firewall. The ZyWALL restricts access by screening data packets against defined access rules. It can also inspect sessions. For example, traffic from one zone is not allowed unless it is initiated by a computer in another zone first.
Chapter 19 Firewall Your customized rules take precedence and override the ZyWALL’s default settings. The ZyWALL checks the schedule, user name (user’s login name on the ZyWALL), source IP address, destination IP address and IP protocol type of network traffic against the firewall rules (in the order you list them). When the traffic matches a rule, the ZyWALL takes the action specified in the rule.
Chapter 19 Firewall The following table explains the default firewall rules for traffic going through the ZyWALL. See Section 19.2.1.2 on page 279 for details on the firewall rules for traffic going to the ZyWALL itself. Table 84 Default Firewall Rules " " FROM ZONE TO ZONE STATEFUL PACKET INSPECTION From LAN to LAN Traffic between interfaces in the LAN is allowed. From LAN to WAN Traffic from the LAN to the WAN is allowed. From LAN to DMZ Traffic from the LAN to the DMZ is allowed.
Chapter 19 Firewall " " The ZyWALL checks the firewall rules before the service control rules for traffic destined for the ZyWALL. You can configure a to-ZyWALL firewall rule (with From Any To ZyWALL direction) for traffic from an interface which is not in a zone. 19.2.2 Firewall and VPN Traffic After you create a VPN tunnel and apply it to a zone, you can set the firewall rules applied to VPN traffic.
Chapter 19 Firewall Your firewall would have the following configuration. Table 85 Blocking All LAN to WAN IRC Traffic Example # USER SOURCE DESTINATIO N SCHEDULE SERVICE ACTION 1 Any Any Any Any IRC Deny Default Any Any Any Any Any Allow • The first row blocks LAN access to the IRC service on the WAN. • The second row is the firewall’s default policy that allows all traffic from the LAN to go to the WAN. The ZyWALL applies the firewall rules in order.
Chapter 19 Firewall Your firewall would have the following configuration. Table 86 Limited LAN to WAN IRC Traffic Example 1 # USER SOURCE DESTINATIO N SCHEDULE SERVICE ACTION 1 Any 192.168.1.7 Any Any IRC Allow 2 Any Any Any Any IRC Deny Default Any Any Any Any Any Allow • The first row allows the LAN computer at IP address 192.168.1.7 to access the IRC service on the WAN. • The second row blocks LAN access to the IRC service on the WAN.
Chapter 19 Firewall You can have the ZyWALL permit the use of asymmetrical route topology on the network (not reset the connection). Allowing asymmetrical routes may let traffic from the WAN go directly to the LAN without passing through the ZyWALL. A better solution is to use virtual interfaces to put the ZyWALL and the backup gateway on separate subnets. 19.5.1 Virtual Interfaces and Asymmetrical Routes You can use virtual interfaces instead of allowing asymmetrical routes.
Chapter 19 Firewall Figure 186 Firewall The following table describes the labels in this screen. Table 88 Firewall LABEL DESCRIPTION Global Setting Enable Firewall Select this check box to activate the firewall. The ZyWALL performs access control when the firewall is activated. Allow Asymmetrical Route If an alternate gateway on the LAN has an IP address in the same subnet as the ZyWALL’s LAN IP address, return traffic may not go through the ZyWALL. This is called an asymmetrical or “triangle” route.
Chapter 19 Firewall Table 88 Firewall (continued) LABEL DESCRIPTION Maximum Use this field to set the highest number of sessions that the ZyWALL will permit a session per host computer with the same IP address to have at one time. When computers use peer to peer applications, such as file sharing applications, they may use a large number of NAT sessions. If you do not limit the number of NAT sessions a single client can establish, this can result in all of the available NAT sessions being used.
Chapter 19 Firewall Table 88 Firewall (continued) LABEL DESCRIPTION Add icon Click the Add icon in the heading row to add a new first entry. The Active icon displays whether the rule is enabled or not. Click it to activate or deactivate the rule. Make sure you click Apply to save and apply the change. Click the Edit icon to go to the screen where you can edit the rule on the ZyWALL. Click the Add icon in an entry to add a rule below the current entry.
Chapter 19 Firewall Table 89 Firewall > Edit (continued) LABEL DESCRIPTION Description Enter a descriptive name of up to 60 printable ASCII characters for the firewall rule. Spaces are allowed. Schedule Select a schedule that defines when the rule applies or select Create Object to configure a new one (see Chapter 37 on page 527 for details). Otherwise, select none and the rule is always effective. User This field is not available when you are configuring a to-ZyWALL rule.
Chapter 19 Firewall Figure 188 Firewall Example: Select the Traveling Direction of Traffic 2 Select From WAN and To LAN and enter a description. Select Create Object in the Destination drop-down list box. Figure 189 Firewall Example: Edit a Firewall Rule 1 3 The screen for configuring an address object opens. Configure it as follows and click OK.
Chapter 19 Firewall Figure 190 Firewall Example: Create an Address Object 4 Select Create Object in the Service drop-down list box. 5 The screen for configuring a service object opens. Configure it as follows and click OK. Figure 191 Firewall Example: Create a Service Object 6 Enter the name of the firewall rule. 7 Make sure Dest_1 is selected for the Destination and MyService is selected as the Service and that the rest of the screen is configured as follows. Click OK when you are done.
Chapter 19 Firewall Figure 193 Firewall Example: MyService Example Rule in Summary 290 ZyWALL USG 1000 User’s Guide
CHAPTER 20 IPSec VPN This chapter explains how to set up and maintain IPSec VPNs in the ZyWALL. See Section 5.4.4 on page 116 for related information on these screens. 20.1 IPSec VPN Overview A virtual private network (VPN) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing.
Chapter 20 IPSec VPN Figure 195 VPN: IKE SA and IPSec SA In this example, a computer in network A is exchanging data with a computer in network B. Inside networks A and B, the data is transmitted the same way data is normally transmitted in the networks. Between routers X and Y, the data is protected by tunneling, encryption, authentication, and other security features of the IPSec SA. The IPSec SA is secure because routers X and Y established the IKE SA first.
Chapter 20 IPSec VPN Usually, you should select ESP. AH does not support encryption, and ESP is more suitable with NAT. 20.1.1.3 Encapsulation There are two ways to encapsulate packets. Usually, you should use tunnel mode because it is more secure. Transport mode is only used when the IPSec SA is used for communication between the ZyWALL and remote IPSec router (for example, for remote management), not between computers on the local and remote networks.
Chapter 20 IPSec VPN If you enable PFS, the ZyWALL and remote IPSec router perform a DH key exchange every time an IPSec SA is established, changing the root key from which encryption keys are generated. As a result, if one encryption key is compromised, other encryption keys remain secure. If you do not enable PFS, the ZyWALL and remote IPSec router use the same root key that was generated when the IKE SA was established to generate encryption keys.
Chapter 20 IPSec VPN • Source address in outbound packets - this translation is necessary if you want the ZyWALL to route packets from computers outside the local network through the IPSec SA. • Source address in inbound packets - this translation hides the source address of computers in the remote network.
Chapter 20 IPSec VPN • Destination - the original destination address; the local network (A). • SNAT - the translated source address; a different IP address (range of addresses) to hide the original source address. 20.1.2.2.3 Destination Address in Inbound Packets (Inbound Traffic, Destination NAT) You can set up this translation if you want the ZyWALL to forward some packets from the remote network to a specific computer in the local network.
Chapter 20 IPSec VPN • Make sure the to-ZyWALL firewall rules allow IPSec VPN traffic to the ZyWALL. IKE uses UDP port 500, AH uses IP protocol 51, and ESP uses IP protocol 50. • The ZyWALL supports UDP port 500 and UDP port 4500 for NAT traversal. If you enable this, make sure the to-ZyWALL firewall rules allow UDP port 4500 too. • Make sure regular firewall rules allow traffic between the VPN tunnel and the rest of the network.
Chapter 20 IPSec VPN Each field is discussed in the following table. See Section 20.3.3 on page 302 and Section 20.3.2 on page 298 for more information. Table 90 VPN > IPSec VPN > VPN Connection LABEL DESCRIPTION # This field is a sequential value, and it is not associated with a specific connection. Name This field displays the name of the IPSec SA. VPN Gateway This field displays the associated VPN gateway(s). If there is no VPN gateway, this field displays “manual key”.
Chapter 20 IPSec VPN Figure 199 VPN > IPSec VPN > VPN Connection > Edit (IKE) Each field is described in the following table. Table 91 VPN > IPSec VPN > VPN Connection > Edit LABEL DESCRIPTION VPN Connection Connection Name Type the name used to identify this IPSec SA. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. VPN Gateway Name Select the VPN gateway that you want to use with this VPN connection.
Chapter 20 IPSec VPN Table 91 VPN > IPSec VPN > VPN Connection > Edit (continued) LABEL DESCRIPTION Active Protocol Select which protocol you want to use in the IPSec SA. Choices are: AH (RFC 2402) - provides integrity, authentication, sequence integrity (replay resistance), and non-repudiation but not encryption. If you select AH, you must select an Authentication algorithm. ESP (RFC 2406) - provides encryption and the same services offered by AH, but its authentication is weaker.
Chapter 20 IPSec VPN Table 91 VPN > IPSec VPN > VPN Connection > Edit (continued) LABEL Policy Enforcement DESCRIPTION Select this if you want the ZyWALL to drop traffic whose source and destination IP addresses do not match the local and remote policy. This makes the IPSec SA more secure. Note: You must clear this field, however, if you want to use the IPSec SA in a VPN concentrator. Local Policy Select the address or address group corresponding to the local network.
Chapter 20 IPSec VPN Table 91 VPN > IPSec VPN > VPN Connection > Edit (continued) LABEL DESCRIPTION SNAT Select the address object that represents the translated source address (or select Create Object to configure a new one). This is the address that hides the original source address. The size of the original source address range (Source) must be equal to the size of the translated source address range (SNAT).
Chapter 20 IPSec VPN Figure 200 VPN > IPSec VPN > VPN Connection > Manual Key > Edit The following table describes the labels in this screen. Table 92 VPN > IPSec VPN > VPN Connection > Manual Key > Edit LABEL DESCRIPTION VPN Connection Connection Name Type the name used to identify this IPSec SA. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. VPN Gateway Name Select manual key in the drop-down list.
Chapter 20 IPSec VPN Table 92 VPN > IPSec VPN > VPN Connection > Manual Key > Edit (continued) LABEL 304 DESCRIPTION Encapsulation Mode Select which type of encapsulation the IPSec SA uses. Choices are Tunnel - this mode encrypts the IP header information and the data Transport - this mode only encrypts the data. You should only select this if the IPSec SA is used for communication between the ZyWALL and remote IPSec router.
Chapter 20 IPSec VPN Table 92 VPN > IPSec VPN > VPN Connection > Manual Key > Edit (continued) LABEL Authentication Key Policy Local Policy DESCRIPTION Enter the authentication key, which depends on the authentication algorithm. MD5 - type a unique key 16-20 characters long SHA1 - type a unique key 20 characters long You can use any alphanumeric characters or ,;|`~!@#$%^&*()_+\{}':./<>=-". If you want to enter the key in hexadecimal, type “0x” at the beginning of the key.
Chapter 20 IPSec VPN Table 92 VPN > IPSec VPN > VPN Connection > Manual Key > Edit (continued) LABEL DESCRIPTION Source NAT This translation hides the source address of computers in the remote network. Source Select the address object that represents the original source address (or select Create Object to configure a new one). This is the address object for the remote network. The size of the original source address range (Source) must be equal to the size of the translated source address range (SNAT).
Chapter 20 IPSec VPN It takes several steps to establish an IKE SA. The negotiation mode determines how many. There are two negotiation modes--main mode and aggressive mode. Main mode provides better security, while aggressive mode is faster. " Both routers must use the same negotiation mode. These modes are discussed in more detail in Section 20.4.2.1 on page 310. Main mode is used in various examples in the rest of this section. 20.4.1.
Chapter 20 IPSec VPN " Both routers must use the same encryption algorithm, authentication algorithm, and DH key group. In most ZyWALLs, you can select one of the following encryption algorithms for each proposal. The algorithms are listed in order from weakest to strongest. • Data Encryption Standard (DES) is a widely used method of data encryption. It applies a 56-bit key to each 64-bit block of data. • Triple DES (3DES) is a variant of DES.
Chapter 20 IPSec VPN In main mode, the ZyWALL and remote IPSec router authenticate each other in steps 5 and 6, as illustrated below. The identities are also encrypted using the encryption algorithm and encryption key the ZyWALL and remote IPSec router selected in previous steps.
Chapter 20 IPSec VPN For example, in Table 93 on page 310, the ZyWALL and the remote IPSec router authenticate each other successfully. In contrast, in Table 94 on page 310, the ZyWALL and the remote IPSec router cannot authenticate each other and, therefore, cannot establish an IKE SA. Table 93 VPN Example: Matching ID Type and Content ZYWALL REMOTE IPSEC ROUTER Local ID type: E-mail Local ID type: IP Local ID content: tom@yourcompany.com Local ID content: 1.1.1.
Chapter 20 IPSec VPN 20.4.2.2 VPN, NAT, and NAT Traversal In the following example, there is another router (A) between router X and router Y. Figure 204 VPN/NAT Example If router A does NAT, it might change the IP addresses, port numbers, or both. If router X and router Y try to establish a VPN tunnel, the authentication fails because it depends on this information. The routers cannot establish a VPN tunnel. Most routers like router A now have an IPSec pass-thru feature.
Chapter 20 IPSec VPN • Instead of using the pre-shared key, the ZyWALL and remote IPSec router check the signatures on each other’s certificates. Unlike pre-shared keys, the signatures do not have to match. • The local and peer ID type and content come from the certificates. " You must set up the certificates for the ZyWALL and remote IPSec router first. 20.4.
Chapter 20 IPSec VPN Table 95 VPN > IPSec VPN > VPN Gateway (continued) LABEL DESCRIPTION Add icon This column provides icons to add, edit, and remove VPN gateways, as well as to activate / deactivate VPN gateways. To add a VPN gateway, click the Add icon at the top of the column. The VPN Gateway Add/Edit screen appears. To edit a VPN gateway, click the Edit icon next to the gateway. The VPN Gateway Add/Edit screen appears accordingly.
Chapter 20 IPSec VPN Figure 206 VPN > IPSec VPN > VPN Gateway > Edit Each field is described in the following table. Table 96 VPN > IPSec VPN > VPN Gateway > Edit LABEL DESCRIPTION VPN Gateway VPN Gateway Name Type the name used to identify this VPN gateway. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 20 IPSec VPN Table 96 VPN > IPSec VPN > VPN Gateway > Edit (continued) LABEL DESCRIPTION Proposal # This field is a sequential value, and it is not associated with a specific proposal. The sequence of proposals should not affect performance significantly. Encryption Select which key size and encryption algorithm to use in the IKE SA.
Chapter 20 IPSec VPN Table 96 VPN > IPSec VPN > VPN Gateway > Edit (continued) LABEL Secure Gateway Address Authentication Method DESCRIPTION Type the IP address or the domain name of the remote IPSec router. Set this field to 0.0.0.0 if the remote IPSec router has a dynamic IP address. You can provide a second IP address or domain name. In this case, if the ZyWALL cannot establish an IKE SA with the first one, it tries to establish an IKE SA with the second one.
Chapter 20 IPSec VPN Table 96 VPN > IPSec VPN > VPN Gateway > Edit (continued) LABEL DESCRIPTION Peer ID Type Select which type of identification is used to identify the remote IPSec router during authentication.
Chapter 20 IPSec VPN Table 96 VPN > IPSec VPN > VPN Gateway > Edit (continued) LABEL DESCRIPTION Apply Click Apply to save your changes in the ZyWALL. Cancel Click Cancel to exit this screen without saving. 20.5 VPN Concentrator A VPN concentrator combines several VPN connections into one secure network. Figure 207 on page 318 shows an example of this, as well as one alternative approach. Figure 207 VPN Topologies 1 2 The VPN concentrator is used in the second approach.
Chapter 20 IPSec VPN 20.5.1 VPN Concentrator Summary You use the VPN Concentrator summary screen to look at the VPN concentrators you have set up. The VPN Concentrator summary screen displays the VPN concentrators in the ZyWALL. To access this screen, click VPN > IPSec VPN > Concentrator. The following screen appears. Figure 208 VPN > IPSec VPN > Concentrator Each field is discussed in the following table. See Section 20.5.2 on page 319 for more information.
Chapter 20 IPSec VPN Each field is described in the following table. Table 98 VPN > IPSec VPN > Concentrator > Edit LABEL DESCRIPTION Name Enter the name of the concentrator. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. # This field is a sequential value, and it is not associated with a specific member in the concentrator. Member This field displays the name of each member in the concentrator.
Chapter 20 IPSec VPN Figure 211 VPN > IPSec VPN > SA Monitor Each field is described in the following table. Table 99 VPN > IPSec VPN > SA Monitor LABEL DESCRIPTION Name Enter the name of a IPSec SA here and click Search to find it (if it is associated). You can use a keyword or regular expression. Use up to 30 alphanumeric and _+-.()!$*^:?|{}[]<>/ characters. See Section 20.6.1 on page 322 for more details.
Chapter 20 IPSec VPN 20.6.1 Regular Expressions in Searching IPSec SAs by Name or Policy A question mark (?) lets a single character in the VPN connection or policy name vary. For example, use “a?c” (without the quotation marks) to specify abc, acc and so on. Wildcards (*) let multiple VPN connection or policy names match the pattern. For example, use “*abc” (without the quotation marks) to specify any VPN connection or policy name that ends with “abc”. A VPN connection named “testabc” would match.
CHAPTER 21 SSL VPN This chapter shows you how to set up secure SSL VPN access for remote user login. See Section 5.4.5 on page 116 for related information on these screens. 21.1 SSL Access Policy An SSL access policy allows the ZyWALL to perform the following tasks: • limit user access to specific applications or files on the network. • allow user access to specific networks. • assign private IP addresses and provide DNS/WINS server information to remote users to access internal networks. 21.1.
Chapter 21 SSL VPN Table 100 Objects (continued) OBJECT TYPE OBJECT SCREEN DESCRIPTION Server Addresses Address Configure address objects for the IP addresses of the DNS and WINS servers that the ZyWALL sends to the VPN connection users. VPN Network Address Configure an address object to specify which network segment users are allowed to access through a VPN connection. 21.1.2 SSL Access Policy Limitations You cannot delete an object that is used by an SSL access policy.
Chapter 21 SSL VPN 21.3 Creating/Editing an SSL Access Policy To create a new or edit an existing SSL access policy, click the Add or Edit icon in the Access Privilege screen. Figure 213 VPN > SSL VPN > Access Privilege > Add/Edit The following table describes the labels in this screen. Table 102 VPN > SSL VPN > Access Privilege > Add/Edit LABEL DESCRIPTION Configuration Enable Select this option to activate this SSL access policy. Name Enter a descriptive name to identify this policy.
Chapter 21 SSL VPN Table 102 VPN > SSL VPN > Access Privilege > Add/Edit (continued) LABEL DESCRIPTION User/Group The Available list displays the name(s) of the user account and/or user group(s) to which you have not applied an SSL access policy yet. To associate a user or user group to this SSL access policy, select a user account or user group and click >> to add to the Member list. You can select more than one name. To remove a user or user group, select the name(s) in the Member list and click <<.
Chapter 21 SSL VPN • log out a user and delete related session information. Once a user logs out, the corresponding entry is removed from the Connection Monitor screen. Figure 214 VPN > SSL VPN > Connection Monitor The following table describes the labels in this screen. Table 103 VPN > SSL VPN > Connection Monitor LABEL DESCRIPTION # This field displays the index number. User This field displays the account user name used to establish this SSL VPN connection.
Chapter 21 SSL VPN Figure 215 VPN > SSL VPN > Global Setting The following table describes the labels in this screen. Table 104 VPN > SSL VPN > Global Setting LABEL DESCRIPTION Global Setting Network Extension IP Address Specify the IP address of the ZyWALL (or a gateway device) for full tunnel mode SSL VPN access. Leave this field to the default settings unless it conflicts with another interface.
Chapter 21 SSL VPN 21.5.1 Uploading a Custom Logo Follow the steps below to upload a custom logo on the ZyWALL. 1 Click VPN > SSL VPN and click the Global Setting tab to display the configuration screen. 2 Click Browse to locate the logo graphic. Make sure the file is in GIF format. 3 Click Apply to start the file transfer process. 4 Log in as a user to verify that the new logo displays properly. The following shows an example logo on the remote user screen. Figure 216 Example Logo Graphic Display 21.
Chapter 21 SSL VPN Figure 217 SSL VPN Client Portal Screen Example If the user account is not set up for SSL VPN access, an “SSL VPN connection is not activated” message displays in the Login screen. Clear the Login to SSL VPN check box and try logging in again. For more information on user portal screens, refer to Chapter 22 on page 331.
CHAPTER 22 SSL User Screens This chapter introduces secure network access and gives an overview of the remote user screens on the ZyWALL. 22.1 Overview The ZyWALL provides secure connections to network resources such as applications, files, intranet sites or e-mail through a web-based interface and using Microsoft Outlook Web Access (OWA). The following figure shows a network example where a remote user (A) logs into the ZyWALL from the Internet to access the web server (WWW) on the local network.
Chapter 22 SSL User Screens • • • • • • Internet Explorer 5.5 and above (for IE7, JRE 1.6 must be enabled) Netscape 7.2 and above Firefox 1.0 and above Mozilla 1.7.3 and above Sun Java Virtual Machine (JVM) installed with a minimum version of 1.4. Java enabled in Internet Explorer on Windows computers. 22.1.3 Information You Need Your network administrator should provide the following information that allows you to log in and access network resources.
Chapter 22 SSL User Screens Figure 220 Login Security Screen 3 A login screen displays. Enter the user name and password of your login account. If a token password is also required, enter it in the One-Time Password field. 4 Select Log into SSL VPN and click Login to log in and establish an SSL VPN connection to the network to access network resources. Figure 221 Login Screen 5 Your computer starts establishing a secure connection to the ZyWALL after a successful login. This may take up to two minutes.
Chapter 22 SSL User Screens " Available resource links vary depending on the configuration your network administrator made. 22.3 SSL VPN User Screens This section describes the main elements in the remote user screens. Figure 223 Remote User Screen 1 2 3 4 5 6 The following table describes the various parts of a remote user screen. Table 105 Remote User Screen Overview 334 # DESCRIPTION 1 Click on a menu tab to go to the Application or File Sharing screen.
Chapter 22 SSL User Screens 22.4 Bookmark You can create a bookmark of the ZyWALL by clicking the Add to Favorite icon. This allows you to access the ZyWALL using the bookmark without having to enter the address every time. 1 In any remote user screen, click the Add to Favorite icon. 2 A screen displays. Accept the default name in the Name field or enter a descriptive name to identify this link. 3 Click OK to create a bookmark in your web browser. Figure 224 Add Favorite 22.
Chapter 22 SSL User Screens 336 ZyWALL USG 1000 User’s Guide
CHAPTER 23 SSL User Application Screens This chapter describes the Application screens you use to access an application on the network through the SSL VPN connection. 23.1 Overview Depending on the configuration of your network administrator, you can use the Application screen to access web-based applications (such as web sites and e-mail). 23.1.1 The Application Screen Click the Application tab to display the screen. The Name field displays the descriptive name for an application.
Chapter 23 SSL User Application Screens 338 ZyWALL USG 1000 User’s Guide
CHAPTER 24 SSL User File Sharing Screens This chapter describes the File Sharing screen you use to access files on a file server through the SSL VPN connection. 24.1 Overview Use the File Sharing screen to display and access shared files/folders on a file server. You can also perform the following actions: • • • • • • • " Access a folder. Open a file (if your web browser cannot open the file, you are prompted to download it). Save a file to your computer. Create a new folder. Rename a file or folder.
Chapter 24 SSL User File Sharing Screens Figure 228 File Sharing 24.3 Opening a File or Folder You can open a file if the file extension is recognized by the web browser and the associated application is installed on your computer. 1 Log in as a remote user and click the File Sharing tab. 2 Click on a file share icon. 3 If an access user name and password are required, a screen displays as shown in the following figure. Enter the account information and click Login to continue.
Chapter 24 SSL User File Sharing Screens 4 A list of files/folders displays. Click on a file to open it in a separate browser window. You can also click a folder to access it. For this example, click on a .doc file to open the Word document. Figure 230 File Sharing: Open a Word File 24.3.1 Downloading a File You are prompted to download a file which cannot be opened using a web browser. Follow the on-screen instructions to download and save the file to your computer.
Chapter 24 SSL User File Sharing Screens Figure 231 File Sharing: Save a Word File 24.4 Creating a New Folder To create a new folder in the file share location, click the New Folder icon. Specify a descriptive name for the folder. You can enter up to 356 characters. Then click Add. " Make sure the length of the folder name does not exceed the maximum allowed on the file server. Figure 232 File Sharing: Save a Word File 24.
Chapter 24 SSL User File Sharing Screens Figure 233 File Sharing: Rename A popup window displays. Specify the new name and/or file extension in the field provided. You can enter up to 356 characters. Then click Apply. " Make sure the length of the name does not exceed the maximum allowed on the file server. You may not be able to open a file if you change the file extension. Figure 234 File Sharing: Rename 24.
Chapter 24 SSL User File Sharing Screens 24.7 Uploading a File Follow the steps below to upload a file to the file server. 1 Log into the remote user screen and click the File Sharing tab. 2 Specify the location and/or name of the file you want to upload. Or click Browse to locate it. 3 Click Upload to send the file to the file server. 4 After the file is uploaded successfully, you should see the name of the file and a message in the screen.
CHAPTER 25 L2TP VPN This chapter explains how to set up and maintain L2TP VPNs in the ZyWALL. See Section 5.4.6 on page 116 for related information on these screens. 25.1 L2TP VPN Overview L2TP VPN lets remote users use the L2TP and IPSec client software included with their computers’ operating systems to securely connect to the network behind the ZyWALL. The remote users do not need their own IPSec gateways or VPN client software.
Chapter 25 L2TP VPN • • • • Use transport mode. Not be a manual key VPN connection. Use Pre-Shared Key authentication. Use a VPN gateway with the Secure Gateway set to 0.0.0.0 if you need to allow L2TP VPN clients to connect from more than one IP address. 25.2.1 Using the Default L2TP VPN Connection Default_L2TP_VPN_Connection is pre-configured to be convenient to use for L2TP VPN. If you use it, edit the following. Configure the local and remote policies as follows.
Chapter 25 L2TP VPN 25.4 L2TP VPN Configuration Click VPN > L2TP VPN to open the following screen. Use this screen to configure the ZyWALL’s L2TP VPN settings. " Disconnect any existing L2TP VPN sessions before modifying L2TP VPN settings. The remote users must make any needed matching configuration changes and re-establish the sessions using the new settings. Figure 239 VPN > L2TP VPN The following table describes the fields in this screen.
Chapter 25 L2TP VPN Table 106 VPN > IPSec VPN > VPN Connection (continued) LABEL DESCRIPTION Allowed User The remote user must log into the ZyWALL to use the L2TP VPN tunnel. Select a user or user group that can use the L2TP VPN tunnel. Select Create Object to configure a new user account (see Section 34.2.1 on page 506 for details). Otherwise, select any to allow any user with a valid account and password on the ZyWALL to log in.
Chapter 25 L2TP VPN Table 107 VPN > L2TP VPN > Session Monitor (continued) LABEL DESCRIPTION Disconnect Click the Disconnect icon next to an L2TP VPN connection to disconnect it. Refresh Click Refresh to update the information in the display.
Chapter 25 L2TP VPN 350 ZyWALL USG 1000 User’s Guide
CHAPTER 26 L2TP VPN Example This chapter shows how to create a basic L2TP VPN tunnel. 26.1 L2TP VPN Example This chapter uses the following settings in creating a basic L2TP VPN tunnel. Figure 241 L2TP VPN Example 172.23.37.205 L2TP_POOL: 192.168.10.10~192.168.10.20 LAN_SUBNET: 192.168.1.0/24 • The ZyWALL has a static IP address of 172.23.37.205 for the ge3 interface. • The remote user has a dynamic public IP address and connects through the Internet.
Chapter 26 L2TP VPN Example Figure 242 VPN > IPSec VPN > VPN Gateway > Edit • Configure the My Address setting. This example uses interface ge3 with static IP address 172.23.37.205. • Configure the Pre-Shared Key. This example uses top-secret. Click OK. 2 Click the Default_L2TP_VPN_GW entry’s Enable icon and click Apply to turn on the entry.
Chapter 26 L2TP VPN Example 26.3 Configuring the Default L2TP VPN Connection Example 1 Click VPN > Network > IPSec VPN to open the screen that lists the VPN connections. Click the Default_L2TP_VPN_Connection’s Edit icon. Figure 244 VPN > IPSec VPN > VPN Connection > Edit 2 Enforce and configure the local and remote policies. • For the Local Policy, create an address object that uses host type and contains the My Address IP address that you configured in the Default_L2TP_VPN_GW.
Chapter 26 L2TP VPN Example Figure 245 VPN > IPSec VPN > VPN Connection (Enable) 26.4 Configuring the L2TP VPN Settings Example 1 Click VPN > L2TP VPN to open the following screen. Figure 246 VPN > L2TP VPN Example 2 Configure the following. • Enable the connection. • Set it to use the Default_L2TP_VPN_Connection VPN connection. • Configure an IP address pool for the range of 192.168.10.10 to 192.168.10.20. It is called L2TP_POOL here.
Chapter 26 L2TP VPN Example Figure 247 Routing > Add: L2TP VPN Example 2 Configure the following. • Enable the policy route. • Set the policy route’s Source Address to the address object that you want to allow the remote users to access (LAN_SUBNET in this example). • Set the Destination Address to the IP address pool that the ZyWALL assigns to the remote users (L2TP_POOL in this example). • Set the next hop to be the Default_L2TP_VPN_Connection VPN tunnel. • Click OK. 26.
Chapter 26 L2TP VPN Example 26.6.1 Configuring L2TP in Windows XP In Windows XP do the following to establish an L2TP VPN connection. 1 Click Start > Control Panel > Network Connections > New Connection Wizard. 2 Click Next in the Welcome screen. 3 Select Connect to the network at my workplace and click Next. Figure 248 New Connection Wizard: Network Connection Type 4 Select Virtual Private Network connection and click Next.
Chapter 26 L2TP VPN Example Figure 250 New Connection Wizard: Connection Name 6 Select Do not dial the initial connection and click Next. Figure 251 New Connection Wizard: Public Network 7 Enter the domain name or WAN IP address configured as the My Address in the VPN gateway configuration that the ZyWALL is using for L2TP VPN (172.23.37.205 in this example).
Chapter 26 L2TP VPN Example Figure 252 New Connection Wizard: VPN Server Selection 8 Click Finish. 9 The Connect L2TP to ZyWALL screen appears. Click Properties > Security. Figure 253 Connect L2TP to ZyWALL 10 Click Security, select Advanced (custom settings) and click Settings.
Chapter 26 L2TP VPN Example Figure 254 Connect L2TP to ZyWALL: Security 11 Select Optional encryption (connect even if no encryption) and the Allow these protocols radio button. Select Unencrypted password (PAP) and clear all of the other check boxes. Click OK. Figure 255 Connect ZyWALL L2TP: Security > Advanced 12 Click IPSec Settings.
Chapter 26 L2TP VPN Example Figure 256 L2TP to ZyWALL Properties > Security 13 Select the Use pre-shared key for authentication check box and enter the pre-shared key used in the VPN gateway configuration that the ZyWALL is using for L2TP VPN. Click OK. Figure 257 L2TP to ZyWALL Properties > Security > IPSec Settings 14 Click Networking. Select L2TP IPSec VPN as the Type of VPN. Click OK. Figure 258 L2TP to ZyWALL Properties: Networking 15 Enter the user name and password of your ZyWALL account.
Chapter 26 L2TP VPN Example Figure 259 Connect L2TP to ZyWALL 16 A window appears while the user name and password are verified. 17 A ZyWALL-L2TP icon displays in your system tray. Double-click it to open a status screen. Figure 260 ZyWALL-L2TP System Tray Icon 18 Click Details to see the address that you received is from the L2TP range you specified on the ZyWALL (192.168.10.10-192.168.10.20).
Chapter 26 L2TP VPN Example 1 Click Start > Run. Type regedit and click OK. Figure 262 Starting the Registry Editor 2 Click Registry > Export Registry File and save a backup copy of your registry. You can go back to using this backup if you misconfigure the registry settings. 3 Select HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parame ters. Figure 263 Registry Key 4 Right-click Parameters and select New > DWORD Value. Figure 264 New DWORD Value 5 Enter ProhibitIpSec as the name.
Chapter 26 L2TP VPN Example Figure 265 ProhibitIpSec DWORD Value 6 Restart the computer and continue with the next section. 26.6.2.2 Configure the Windows 2000 IPSec Policy After you have created the registry entry and restarted the computer, use these directions to configure an IPSec policy for the computer to use. 1 Click Start > Run. Type mmc and click OK. Figure 266 Run mmc 2 Click Console > Add/Remove Snap-in.
Chapter 26 L2TP VPN Example Figure 268 Add > IP Security Policy Management > Finish 4 Right-click IP Security Policies on Local Machine and click Create IP Security Policy. Click Next in the welcome screen. Figure 269 Create IP Security Policy 5 Name the IP security policy L2TP to ZyWALL, and click Next.
Chapter 26 L2TP VPN Example Figure 270 IP Security Policy: Name 6 Clear the Activate the default response rule check box and click Next. Figure 271 IP Security Policy: Request for Secure Communication 7 Leave the Edit Properties check box selected and click Finish.
Chapter 26 L2TP VPN Example 8 In the properties dialog box, click Add > Next. Figure 273 IP Security Policy Properties > Add 9 Select This rule does not specify a tunnel and click Next. Figure 274 IP Security Policy Properties: Tunnel Endpoint 10 Select All network connections and click Next.
Chapter 26 L2TP VPN Example Figure 275 IP Security Policy Properties: Network Type 11 Select Use this string to protect the key exchange (preshared key), type password in the text box, and click Next. Figure 276 IP Security Policy Properties: Authentication Method 12 Click Add.
Chapter 26 L2TP VPN Example Figure 277 IP Security Policy Properties: IP Filter List 13 Type ZyWALL WAN_IP in the Name field. Clear the Use Add Wizard check box and click Add. Figure 278 IP Security Policy Properties: IP Filter List > Add 14 Configure the following in the Addressing tab. Select My IP Address in the Source address drop-down list box. Select A specific IP Address in the Destination address drop-down list box and type the ZyWALL’s WAN IP address (172.23.37.
Chapter 26 L2TP VPN Example Figure 279 Filter Properties: Addressing 15 Configure the following in the Filter Properties window’s Protocol tab. Set the protocol type to UDP from port 1701. Select To any port. Click Apply, OK, and then Close. Figure 280 Filter Properties: Protocol 16 Select ZyWALL WAN_IP and click Next.
Chapter 26 L2TP VPN Example Figure 281 IP Security Policy Properties: IP Filter List 17 Select Require Security and click Next. Then click Finish and Close. Figure 282 IP Security Policy Properties: IP Filter List 18 In the Console window, right-click L2TP to ZyWALL and select Assign.
Chapter 26 L2TP VPN Example 26.6.2.3 Configure the Windows 2000 Network Connection After you have configured the IPSec policy, use these directions to create a network connection. 1 Click Start > Settings > Network and Dial-up connections > Make New Connection. In the wizard welcome screen, click Next. Figure 284 Start New Connection Wizard 2 Select Connect to a private network through the Internet and click Next.
Chapter 26 L2TP VPN Example Figure 286 New Connection Wizard: Destination Address 4 Select For all users and click Next. Figure 287 New Connection Wizard: Connection Availability 5 Name the connection L2TP to ZyWALL and click Finish.
Chapter 26 L2TP VPN Example 6 Click Properties. Figure 289 Connect L2TP to ZyWALL 7 Click Security and select Advanced (custom settings) and click Settings. Figure 290 Connect L2TP to ZyWALL: Security 8 Select Optional encryption allowed (connect even if no encryption) and the Allow these protocols radio button. Select Unencrypted password (PAP) and clear all of the other check boxes. Click OK. Click Yes if a screen pops up.
Chapter 26 L2TP VPN Example Figure 291 Connect L2TP to ZyWALL: Security > Advanced 9 Click Networking and select Layer 2 Tunneling Protocol (L2TP) from the drop-down list box. Click OK. Figure 292 Connect L2TP to ZyWALL: Networking 10 Enter your user name and password and click Connect. It may take up to one minute to establish the connection and register on the network.
Chapter 26 L2TP VPN Example Figure 293 Connect L2TP to ZyWALL 11 A ZyWALL-L2TP icon displays in your system tray. Double-click it to open a status screen. Figure 294 ZyWALL-L2TP System Tray Icon 12 Click Details and scroll down to see the address that you received is from the L2TP range you specified on the ZyWALL (192.168.10.10-192.168.10.20). Figure 295 L2TP to ZyWALL Status: Details 13 Access a server or other network resource behind the ZyWALL to make sure your access works.
Chapter 26 L2TP VPN Example 376 ZyWALL USG 1000 User’s Guide
P ART IV Application Patrol & Anti-X Application Patrol (379) Anti-Virus (403) IDP (417) ADP (445) Content Filter Screens (463) Content Filter Reports (483) 377
CHAPTER 27 Application Patrol This chapter describes how to use application patrol for the ZyWALL. It provides an overview first and then introduces the screens. See Section 5.4.13 on page 119 for related information on these screens. 27.1 Application Patrol Overview Application patrol provides a convenient way to manage the use of various applications on the network.
Chapter 27 Application Patrol " The ZyWALL allows the first eight packets to go through the firewall, regardless of the application patrol policy for the application. The ZyWALL examines these first eight packets to identify the application. The second approach is called service ports. In this approach, the ZyWALL only uses OSI level-3 information, such as IP address and port, to identify what application is using the connection.
Chapter 27 Application Patrol 27.4.1 Connection and Packet Directions Application patrol looks at the connection direction, that is from which zone the connection was initiated and to which zone the connection is going. A connection has outbound and inbound packet flows. The ZyWALL controls the bandwidth of traffic of each flow as it is going out through an interface or VPN tunnel. • The outbound traffic flows from the connection initiator to the connection responder.
Chapter 27 Application Patrol Figure 297 LAN to WAN, Outbound 200 kbps, Inbound 500 kbps WAN LAN GE1 GE2 DMZ GE3 GE4 GE5 Outbound: 200 kbps Inbound: 500 kbps Outbound: 200 kbps 27.4.3 Bandwidth Management Priority The ZyWALL gives bandwidth to higher-priority traffic first, until it reaches its configured bandwidth rate. Then lower-priority traffic gets bandwidth. The ZyWALL uses a fairness-based (round-robin) scheduler to divide bandwidth among traffic flows with the same priority.
Chapter 27 Application Patrol Figure 298 Bandwidth Management Behavior BWM 1000 kbps 1000 kbps 1000 kbps 27.4.5.1 Configured Rate Effect In the following table the configured rates total less than the available bandwidth and maximize bandwidth usage is disabled, both servers get their configured rate. Table 108 Configured Rate Effect POLICY CONFIGURED RATE MAX. B. U. PRIORITY ACTUAL RATE A 300 kbps No 1 300 kbps B 200 kbps No 1 200 kbps 27.4.5.
Chapter 27 Application Patrol 27.4.5.4 Priority and Over Allotment of Bandwidth Effect Server A has a configured rate that equals the total amount of available bandwidth and a higher priority. You should regard extreme over allotment of traffic with different priorities (as shown here) as a configuration error. Even though the ZyWALL still attempts to let all traffic get through and not be lost, regardless of its priority, server B gets almost no bandwidth with this configuration.
Chapter 27 Application Patrol Figure 299 Application Patrol Bandwidth Management Example SIP: Any to WAN Outbound: 200 Kbps Inbound: 200 Kbps Priority: 1 Max. B. U. SIP: WAN to Any Outbound: 200 Kbps Inbound: 200 Kbps Priority: 1 Max. B. U. HTTP: Any to WAN Outbound: 100 Kbps Inbound: 500 Kbps Priority: 2 Max. B. U. ADSL Up: 1 Mbps Down 8 Mbps FTP: WAN to DMZ Outbound: 100 Kbps Inbound: 300 Kbps Priority: 3 No Max. B. U. FTP: LAN to DMZ Outbound: 50 Mbps Inbound: 50 Mbps Priority: 4 No Max. B. U. 27.5.
Chapter 27 Application Patrol Figure 300 SIP Any to WAN Bandwidth Management Example Outbound: 200 kbps BWM BWM Inbound: 200 kbps 27.5.3 SIP WAN to Any Bandwidth Management Example You also create a policy for calls coming in from the SIP server on the WAN. It is the same as the SIP Any to WAN policy, but with the directions reversed (WAN to Any instead of Any to WAN). 27.5.
Chapter 27 Application Patrol • Third highest priority (3). • Disable maximize bandwidth usage since you do not want to give FTP more bandwidth. Figure 302 FTP WAN to DMZ Bandwidth Management Example Outbound: 300 kbps BWM BWM Inbound: 100 kbps 27.5.6 FTP LAN to DMZ Bandwidth Management Example • The LAN and DMZ zone interfaces are connected to Ethernet networks (not an ADSL device) so you limit both outbound and inbound traffic to 50 Mbps. • Fourth highest priority (4).
Chapter 27 Application Patrol 27.6 Other Applications Sometimes, the ZyWALL cannot identify the application. For example, the application might be a new application, or the packets might arrive out of sequence. (The ZyWALL does not reorder packets when identifying the application.) In these cases, you can still provide a default rule for the ZyWALL to follow.
Chapter 27 Application Patrol Figure 304 AppPatrol > General The following table describes the labels in this screen. See Section 27.9.1 on page 391 for more information as well. Table 112 AppPatrol > General LABEL DESCRIPTION Enable Application Patrol Select this check box to turn on application patrol. Enable BWM This is a global setting for enabling or disabling bandwidth management on the ZyWALL.
Chapter 27 Application Patrol Table 112 AppPatrol > General (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 27.9 Application Patrol Applications Use the application patrol Common, Instant Messenger, Peer to Peer, VoIP, or Streaming screen to manage traffic of individual applications.
Chapter 27 Application Patrol 27.9.1 Application Patrol Edit Use this screen to edit the settings for an application. To access this screen, go to the application patrol Common, Instant Messenger, Peer to Peer, VoIP, or Streaming screen and click an application’s Edit icon. The screen displayed here is for the MSN instant messenger service. Figure 306 Application Edit The following table describes the labels in this screen.
Chapter 27 Application Patrol Table 114 Application Edit (continued) LABEL # DESCRIPTION This field is a sequential value, and it is not associated with a specific condition. Note: The ZyWALL checks conditions in the order they appear in the list. While this sequence does not affect the functionality, you might improve the performance of the ZyWALL by putting more common conditions at the top of the list. 392 Port This field displays the specific port number to which this policy applies.
Chapter 27 Application Patrol Table 114 Application Edit (continued) LABEL Add icon DESCRIPTION Click the Add icon in the heading row to add a new first entry. The Active icon displays whether the entry is enabled or not. Click the Active icon to activate or deactivate the entry. Make sure you click Apply to save and apply the change. Click the Edit icon to go to the screen where you can edit the entry. Click the Add icon in an entry to add a new entry below the current entry.
Chapter 27 Application Patrol Table 115 Application Policy Edit (continued) LABEL DESCRIPTION Schedule Select a schedule that defines when the policy applies or select Create Object to configure a new one (see Chapter 37 on page 527 for details). Otherwise, select none to make the policy always effective. User Select a user name or user group to which to apply the policy. Select Create Object to configure a new user account (see Section 34.2.1 on page 506 for details).
Chapter 27 Application Patrol Table 115 Application Policy Edit (continued) LABEL DESCRIPTION Outbound kbps Type how much outbound bandwidth, in kilobits per second, this policy allows the application to use. Outbound refers to the traffic the ZyWALL sends out from a connection’s initiator. If you enter 0 here, this policy does not apply bandwidth management for the application’s traffic that the ZyWALL sends out from the initiator.
Chapter 27 Application Patrol The following table describes the labels in this screen. See Section 27.10.1 on page 397 for more information as well. Table 116 AppPatrol > Other LABEL DESCRIPTION Policy This table lists the policies configured for traffic which does not match an application. # This field is a sequential value, and it is not associated with a specific condition. Note: The ZyWALL checks conditions in the order they appear in the list.
Chapter 27 Application Patrol Table 116 AppPatrol > Other (continued) LABEL Add icon DESCRIPTION Click the Add icon in the heading row to add a new first entry. The Active icon displays whether the entry is enabled or not. Click the Active icon to activate or deactivate the entry. Make sure you click Apply to save and apply the change. Click the Edit icon to go to the screen where you can edit the entry. Click the Add icon in an entry to add a new entry below the current entry.
Chapter 27 Application Patrol Table 117 AppPatrol > Other > Edit (continued) LABEL DESCRIPTION Schedule Select a schedule that defines when the policy applies or select Create Object to configure a new one (see Chapter 37 on page 527 for details). Otherwise, select any to make the policy always effective. User Select a user name or user group to which to apply the policy. Select Create Object to configure a new user account (see Section 34.2.1 on page 506 for details).
Chapter 27 Application Patrol Table 117 AppPatrol > Other > Edit (continued) LABEL DESCRIPTION Priority Enter a number between 1 and 7 to set the priority for traffic that matches this policy. The smaller the number, the higher the priority. Traffic with a higher priority is given bandwidth before traffic with a lower priority. The ZyWALL uses a fairness-based (round-robin) scheduler to divide bandwidth between traffic flows with the same priority.
Chapter 27 Application Patrol The following table describes the labels in this screen. Table 118 AppPatrol > Statistics: General Setup LABEL DESCRIPTION Refresh Interval Select how often you want the statistics display to update. Display Protocols Select the protocols for which to display statistics. Select All selects all of the protocols. Clear All clears all of the protocols. Click Expand to display individual protocols. Collapse hides them.
Chapter 27 Application Patrol Figure 312 AppPatrol > Statistics: Protocol Statistics The following table describes the labels in this screen. Table 119 AppPatrol > Statistics: Protocol Statistics LABEL DESCRIPTION Service This is the protocol. Click the expand icon (+) to display the statistics for each of a protocol’s rules. Click the close icon (-) to hide the statistics for each of a protocol’s rules.
Chapter 27 Application Patrol Table 119 AppPatrol > Statistics: Protocol Statistics (continued) LABEL 402 DESCRIPTION Forwarded Data (KB) This is how much of the application’s traffic the ZyWALL has sent (in kilobytes). Dropped Data (KB) This is how much of the application’s traffic the ZyWALL has discarded without notifying the client (in kilobytes). This traffic was dropped because it matched a policy set to “drop”.
CHAPTER 28 Anti-Virus This chapter introduces and shows you how to configure the anti-virus scanner. See Section 5.4.14 on page 120 for related information on these screens. 28.1 Anti-Virus Overview A computer virus is a small program designed to corrupt and/or alter the operation of other legitimate programs. A worm is a self-replicating virus that resides in active memory and duplicates itself.
Chapter 28 Anti-Virus 4 Once the virus is spread through the network, the number of infected networked computers can grow exponentially. 28.1.3 Types of Anti-Virus Scanner The section describes two types of anti-virus scanner: host-based and network-based. A host-based anti-virus (HAV) scanner is often software installed on computers and/or servers in the network. It inspects files for virus patterns as they are moved in and out of the hard drive.
Chapter 28 Anti-Virus Figure 313 ZyWALL Anti-virus Example The following describes the virus scanning process on the ZyWALL. 1 The ZyWALL first identifies SMTP, POP3, IMAP4, HTTP and FTP packets through standard ports. 2 If the packets are not session connection setup packets (such as SYN, ACK and FIN), the ZyWALL records the sequence of the packets. 3 The scanning engine checks the contents of the packets for virus.
Chapter 28 Anti-Virus • Encrypted traffic. This could be password-protected files or VPN traffic where the ZyWALL is not the endpoint (pass-through VPN traffic). • Traffic through custom (non-standard) ports. The only exception is FTP traffic. The ZyWALL scans whatever port number is specified for FTP in the ALG screen. • ZIP file(s) within a ZIP file. 28.3 Anti-Virus Summary Click Anti-X > Anti-Virus to display the configuration screen as shown next.
Chapter 28 Anti-Virus The following table describes the labels in this screen. Table 121 Anti-X > Anti-Virus > General LABEL DESCRIPTION Enable Anti-Virus and Anti-Spyware Select this check box to check traffic for viruses and spyware. The following table lists rules that define which traffic the ZyWALL scans and the action it takes upon finding a virus. Priority This is the position of an anti-virus rule in the list.
Chapter 28 Anti-Virus Table 121 Anti-X > Anti-Virus > General (continued) LABEL DESCRIPTION Released Date This field displays the date and time the set was released. Update Signatures Click this link to go to the screen you can use to download signatures from the update server. Apply Click Apply to save your changes. Reset Click Reset to start configuring this screen again. 28.3.
Chapter 28 Anti-Virus Table 122 Anti-X > Anti-Virus > General > Edit (continued) LABEL DESCRIPTION Protocols to Scan Select which protocols of traffic to scan for viruses. FTP applies to traffic using the TCP port number specified for FTP in the ALG screen. HTTP applies to traffic using TCP ports 80, 8080 and 3128. SMTP applies to traffic using TCP port 25. POP3 applies to traffic using TCP port 110. IMAP4 applies to traffic using TCP port 143.
Chapter 28 Anti-Virus Table 122 Anti-X > Anti-Virus > General > Edit (continued) LABEL Destroy compressed files that could not be decompressed DESCRIPTION Note: When you select this option, the ZyWALL deletes ZIP files that use password encryption. Select this check box to have the ZyWALL delete any ZIP files that it is not able to unzip. The ZyWALL cannot unzip password protected ZIP files or a ZIP file within another ZIP file.
Chapter 28 Anti-Virus The following table describes the labels in this screen. Table 123 Anti-X > Anti-Virus > Setting LABEL DESCRIPTION Scan EICAR Select this option to have the ZyWALL check for the EICAR test file and treat it in the same way as a real virus file. The EICAR test file is a standardized test file for signature based anti-virus scanners. When the virus scanner detects the EICAR file, it responds in the same way as if it found a real virus.
Chapter 28 Anti-Virus Table 123 Anti-X > Anti-Virus > Setting (continued) LABEL DESCRIPTION Apply Click Apply to save your changes. Reset Click Reset to start configuring this screen again. 28.5 Anti-Virus White List Add/Edit From the Anti-X > Anti-Virus > Setting screen, click a white list Add icon or Edit icon to display the following screen. Use this screen to create an anti-virus white list entry for a file pattern that should cause the ZyWALL to not scan a file for viruses.
Chapter 28 Anti-Virus 28.6 Anti-Virus Black List Add/Edit From the Anti-X > Anti-Virus > Setting screen, click a black list Add icon or Edit icon to display the following screen. Use this screen to create an anti-virus black list entry for a file pattern that should cause the ZyWALL to log and delete a file. Figure 318 Anti-X > Anti-Virus > Setting > Black List Add The following table describes the labels in this screen.
Chapter 28 Anti-Virus Figure 319 Anti-X > Anti-Virus > Signature: Search by Severity The following table describes the labels in this screen. Table 126 Anti-X > Anti-Virus > Signature LABEL DESCRIPTION Signatures Search Select the criteria on which to perform the search. Select By Name from the drop down list box and type the name or part of the name of the signature(s) you want to find. This search is not case-sensitive.
Chapter 28 Anti-Virus Table 126 Anti-X > Anti-Virus > Signature (continued) LABEL DESCRIPTION Severity This is the severity level of the anti-virus signature. Click the severity column header to sort your search results by ascending or descending severity. Category This column displays whether the signature is for identifying a virus or spyware. Click the column heading to sort your search results by category.
Chapter 28 Anti-Virus 416 ZyWALL USG 1000 User’s Guide
CHAPTER 29 IDP This chapter introduces IDP (Intrusion, Detection and Prevention), IDP profiles, binding an IDP profile to a traffic direction, custom signatures and updating signatures. See Section 5.4.15 on page 120 for related information on these screens. 29.1 Introduction to IDP An IDP system can detect malicious or suspicious packets and respond instantaneously. It is designed to detect pattern-based attacks. 29.1.
Chapter 29 IDP 29.1.4 Signatures If a packet matches a signature, the action specified by the signature is taken. You can change the default signature actions in the profile screens. 29.2 Traffic Directions and Profiles A zone is a combination of ZyWALL interfaces and VPN connections for security. See the zone chapter for details on zones and the interfaces chapter for details on interfaces. Traffic direction is defined by the zone the traffic is coming from and the zone the traffic is going to.
Chapter 29 IDP Figure 320 Anti-X > IDP > General The following table describes the screens in this screen. Table 127 Anti-X > IDP > General LABEL DESCRIPTION General Setup Enable Signature Detection Bindings You must register for IDP service in order to use packet inspection signatures. If you don’t have a standard license, you can register for a once-off trial one. Use this list to specify which IDP profile the ZyWALL uses for traffic flowing in a specific direction.
Chapter 29 IDP Table 127 Anti-X > IDP > General (continued) LABEL (Icons) Registration DESCRIPTION Click the Add icon in the heading row to add a new first entry. The Active icon displays whether the entry is enabled or not. Click it to activate or deactivate the entry. Make sure you click Apply to save and apply the change. Click the Edit icon to go to the screen where you can edit the entry. Click the Add icon in an entry to add an entry below the current entry.
Chapter 29 IDP Figure 321 Anti-X > IDP > General > Add The following table describes the screens in this screen. Table 128 Anti-X > IDP > General > Add LABEL DESCRIPTION Enable Select this check box to turn on this IDP profile to traffic direction binding. From Traffic direction is defined by the zone the traffic is coming from and the zone the traffic is going to. Use the From field to specify the zone from which the traffic is coming.
Chapter 29 IDP Figure 322 Base Profiles The following table describes this screen. Table 129 Base Profiles BASE PROFILE DESCRIPTION all All signatures are enabled. Signatures with a high or severe severity level (greater than three) generate log alerts and cause packets that trigger them to be dropped. Signatures with a very low, low or medium severity level (less than or equal to three) generate logs (not log alerts) and no action is taken on packets that trigger them.
Chapter 29 IDP Figure 323 Anti-X > IDP > Profile The following table describes the fields in this screen. Table 130 Anti-X > IDP > Profile LABEL DESCRIPTION Name This is the name of the profile you created. Base Profile This is the base profile from which the profile was created. (Icons) Click the Add icon in the column header to create a new profile. A pop-up screen displays requiring you to choose a base profile from which to create the new profile. Click an Edit icon to edit an existing profile.
Chapter 29 IDP " If Internet Explorer opens a warning screen about a script making Internet Explorer run slowly and the computer maybe becoming unresponsive, just click No to continue. 3 Type a new profile name 4 Enable or disable individual signatures. 5 Edit the default log options and actions. 29.8 Profiles: Packet Inspection Select Anti-X > IDP > Profile and then add a new or edit an existing profile select. Packet inspection signatures examine the contents of a packet for malicious data.
Chapter 29 IDP Figure 324 Anti-X > IDP > Profile > Edit : Group View ZyWALL USG 1000 User’s Guide 425
Chapter 29 IDP The following table describes the fields in this screen. Table 131 Anti-X > IDP > Profile > Group View 426 LABEL DESCRIPTION Name This is the name of the profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 29 IDP Table 131 Anti-X > IDP > Profile > Group View (continued) LABEL DESCRIPTION Action Select what action the ZyWALL should take when a packet matches a signature here. original setting: Select this action to return each signature in a service group to its previously saved configuration. none: Select this action on an individual signature or a complete service group to have the ZyWALL take no action when a packet matches the signature(s).
Chapter 29 IDP Table 132 Policy Types (continued) POLICY TYPE DESCRIPTION DoS/DDoS The goal of Denial of Service (DoS) attacks is not to steal information, but to disable a device or network on the Internet. A distributed denial-of-service (DDoS) attack is one in which multiple compromised systems attack a single target, thereby causing denial of service for users of the targeted system. Scan A scan describes the action of searching a network for an exposed service.
Chapter 29 IDP Table 133 IDP Service Groups (continued) IMAP IM FINGER DNS ICMP FTP The following figure shows the WEB_PHP service group that contains signatures related to attacks on web servers using PHP exploits. PHP (PHP: Hypertext Preprocessor) is a serverside HTML embedded scripting language that allows web developers to build dynamic websites. Logs and actions applied to a service group apply to all signatures within that group.
Chapter 29 IDP Figure 326 Anti-X > IDP > Profile: Query View The following table describes the fields in this screen. Table 134 Anti-X > IDP > Profile: Query View 430 LABEL DESCRIPTION Name This is the name of the profile that you created in the IDP > Profiles > Group View screen. Switch to group view Click this button to go to the IDP profile group view screen where IDP signatures are grouped by service and you can configure activation, logs and/or actions.
Chapter 29 IDP Table 134 Anti-X > IDP > Profile: Query View (continued) LABEL DESCRIPTION Search Click this button to begin the search. The results display at the bottom of the screen. Results may be spread over several pages depending on how broad the search criteria selected were. The tighter the criteria selected, the fewer the signatures returned.
Chapter 29 IDP Figure 328 Query Example Search Results 29.9 Introducing IDP Custom Signatures Create custom signatures for new attacks or attacks peculiar to your network. Custom signatures can also be saved to/from your computer so as to share with others. You need some knowledge of packet headers and attack types to create your own custom signatures. 29.9.1 IP Packet Header These are the fields in an Internet Protocol (IP) version 4 packet header.
Chapter 29 IDP Figure 329 IP v4 Packet Headers The header fields are discussed below: Table 135 IP v4 Packet Headers HEADER DESCRIPTION Version The value 4 indicates IP version 4. IHL IP Header Length is the number of 32 bit words forming the total length of the header (usually five). Type of Service The Type of Service, (also known as Differentiated Services Code Point (DSCP)) is usually set to 0, but may indicate particular quality of service needs from the network.
Chapter 29 IDP Table 135 IP v4 Packet Headers (continued) HEADER DESCRIPTION Options IP options is a variable-length list of IP options for a datagram that define IP Security Option, IP Stream Identifier, (security and handling restrictions for the military), Record Route (have each router record its IP address), Loose Source Routing (specifies a list of IP addresses that must be traversed by the datagram), Strict Source Routing (specifies a list of IP addresses that must ONLY be traversed by the datagra
Chapter 29 IDP The following table describes the fields in this screen. Table 136 Anti-X > IDP > Custom Signatures LABEL DESCRIPTION Creating Use this part of the screen to create, edit, delete or export (save to your computer) custom signatures. SID SID is the signature ID that uniquely identifies a signature. Click the SID header to sort signatures in ascending or descending order. It is automatically created when you click the Add icon to create a new signature.
Chapter 29 IDP Figure 331 Anti-X > IDP > Custom Signatures > Add/Edit 436 ZyWALL USG 1000 User’s Guide
Chapter 29 IDP The following table describes the fields in this screen. Table 137 Anti-X > IDP > Custom Signatures > Add/Edit LABEL DESCRIPTION Name Type the name of your custom signature. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 29 IDP Table 137 Anti-X > IDP > Custom Signatures > Add/Edit (continued) LABEL DESCRIPTION IP Options IP options is a variable-length list of IP options for a datagram that define IP Security Option, IP Stream Identifier, (security and handling restrictions for the military), Record Route (have each router record its IP address), Loose Source Routing (specifies a list of IP addresses that must be traversed by the datagram), Strict Source Routing (specifies a list of IP addresses that must ONLY be
Chapter 29 IDP Table 137 Anti-X > IDP > Custom Signatures > Add/Edit (continued) LABEL DESCRIPTION Payload Size This field may be used to check for abnormally sized packets or for detecting buffer overflows. Select the check box, then select Equal, Smaller or Greater and then type the payload size. Stream rebuilt packets are not checked regardless of the size of the payload. Offset This field specifies where to start searching for a pattern within a packet.
Chapter 29 IDP 29.10.2.2 Analyze Packets Then use a packet sniffer such as TCPdump or Ethereal to investigate some more. From the NetBIOS header you see that the first byte ‘00’ defines the message type. The next three bytes represent the length of data, so you can ignore it. Therefore enter |00| as the first pattern. Figure 332 Custom Signature Example Pattern 1 Next, check the content of the SMB header. Add |FF|SMB% and ‘TransactionNmPipe’ to the signature as the next patterns.
Chapter 29 IDP Figure 335 Example Custom Signature ZyWALL USG 1000 User’s Guide 441
Chapter 29 IDP 29.10.3 Applying Custom Signatures After you create your custom signature, it becomes available in the IDP service group category in the IDP > Profile > Packet Inspection screen. Custom signatures have an SID from 9000000 to 9999999. You can activate the signature, configure what action to take when a packet matches it and if it should generate a log or alert in a profile. Then bind the profile to a zone. Figure 336 Example: Custom Signature in IDP Profile 29.10.
Chapter 29 IDP Figure 337 Custom Signature Log 29.10.5 Snort Signatures You may want to refer to open source Snort signatures when creating custom ZyWALL ones. Most Snort rules are written in a single line. Snort rules are divided into two logical sections, the rule header and the rule options as shown in the following example: alert tcp any any -> 192.168.1.
Chapter 29 IDP Table 138 ZyWALL - Snort Equivalent Terms (continued) ZYWALL TERM SNORT EQUIVALENT TERM Flow flow Flags flags Sequence Number seq Ack Number ack Window Size window Transport Protocol: UDP Port (In Snort rule header) (In Snort rule header) Transport Protocol: ICMP Type itype Code icode ID icmp_id Sequence Number icmp_seq Payload Options " 444 (Snort rule options) Payload Size dsize Offset (relative to start of payload) offset Relative to end of last match distanc
CHAPTER 30 ADP This chapter introduces ADP (Anomaly Detection and Prevention), anomaly profiles and binding an ADP profile to a traffic direction. See Section 5.4.16 on page 120 for related information on these screens. 30.1 Introduction to ADP An ADP system can detect malicious or suspicious packets and respond instantaneously. It can detect: • Anomalies based on violations of protocol standards (RFCs – Requests for Comments) • Abnormal flows such as port scans. 30.1.
Chapter 30 ADP 30.1.3 ADP on the ZyWALL ADP on the ZyWALL protects against network-based intrusions. See Section 30.8 on page 450 and Section 30.9 on page 456 for more on the kinds of attacks that the ZyWALL can protect against. You can also create your own custom ADP rules. 30.2 Traffic Directions and Profiles A zone is a combination of ZyWALL interfaces and VPN connections for security. See the zone chapter for details on zones and the interfaces chapter for details on interfaces.
Chapter 30 ADP The following table describes the screens in this screen. Table 139 Anti-X > ADP > General LABEL DESCRIPTION General Setup Enable Anomaly Detection Bindings Select this check box to enable traffic anomaly and protocol anomaly detection. Use this list to specify which anomaly profile the ZyWALL uses for traffic flowing in a specific direction. Priority This is this binding’s rank in the list of anomaly profile to traffic direction bindings. The list is applied in order of priority.
Chapter 30 ADP Figure 339 Anti-X > ADP > General > Add The following table describes the screens in this screen. Table 140 Anti-X > ADP > General > Add LABEL DESCRIPTION Enable Select this check box to turn on this anomaly profile to traffic direction binding. From Traffic direction is defined by the zone the traffic is coming from and the zone the traffic is going to. Use the From field to specify the zone from which the traffic is coming.
Chapter 30 ADP Figure 340 Base Profiles These are the default base profiles at the time of writing. Table 141 Base Profiles BASE PROFILE DESCRIPTION all All traffic anomaly and protocol anomaly rules are enabled. Rules with a high or severe severity level (greater than three) generate log alerts and cause packets that trigger them to be dropped.
Chapter 30 ADP Table 142 Anti-X > ADP > Profile (continued) LABEL DESCRIPTION Base Profile This is the base profile from which the profile was created. (Icons) Click the Add icon in the column header to create a new profile. A pop-up screen displays requiring you to choose a base profile from which to create the new profile. Click an Edit icon to edit an existing profile. Click a Remove icon to delete an existing profile. 30.
Chapter 30 ADP 30.8.1 Port Scanning An attacker scans device(s) to determine what types of network protocols or services a device supports. One of the most common port scanning tools in use today is Nmap. Many connection attempts to different ports (services) may indicate a port scan.
Chapter 30 ADP 30.8.1.4 Filtered Port Scans A filtered port scan may indicate that there were no network errors (ICMP unreachables or TCP RSTs) or responses on closed ports have been suppressed. Active network devices, such as NAT routers, may trigger these alerts if they send out many connection attempts within a very small amount of time. These are some filtered port scan examples.
Chapter 30 ADP 30.8.2.3 TCP SYN Flood Attack Usually a client starts a session by sending a SYN (synchronize) packet to a server. The receiver returns an ACK (acknowledgment) packet and its own SYN, and then the initiator responds with an ACK (acknowledgment). After this handshake, a connection is established. Figure 343 TCP Three-Way Handshake A SYN flood attack is when an attacker sends a series of SYN packets. Each packet causes the receiver to reply with a SYN-ACK response.
Chapter 30 ADP 30.8.2.5 UDP Flood Attack UDP is a connection-less protocol and it does not require any connection setup procedure to transfer data. A UDP flood attack is possible when an attacker sends a UDP packet to a random port on the victim system. When the victim system receives a UDP packet, it will determine what application is waiting on the destination port.
Chapter 30 ADP 30.8.
Chapter 30 ADP The following table describes the fields in this screen. Table 143 ADP > Profile > Traffic Anomaly LABEL DESCRIPTION Name This is the name of the ADP profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 30 ADP Protocol anomaly detection includes HTTP Inspection, TCP Decoder, UDP Decoder and ICMP Decoder where each category reflects the packet type inspected. Protocol anomaly rules may be updated when you upload new firmware. 30.9.1 HTTP Inspection and TCP/UDP/ICMP Decoders The following table gives some information on the HTTP inspection, TCP decoder, UDP decoder and ICMP decoder ZyWALL protocol anomaly rules.
Chapter 30 ADP Table 144 HTTP Inspection and TCP/UDP/ICMP Decoders (continued) LABEL DESCRIPTION OVERSIZE-CHUNKENCODING ATTACK This rule is an anomaly detector for abnormally large chunk sizes. This picks up the apache chunk encoding exploits and may also be triggered on HTTP tunneling that uses chunk encoding. OVERSIZE-REQUEST-URIDIRECTORY ATTACK This rule takes a non-zero positive integer as an argument. The argument specifies the max character directory length for URL directory.
Chapter 30 ADP Table 144 HTTP Inspection and TCP/UDP/ICMP Decoders (continued) LABEL DESCRIPTION TRUNCATED-HEADER ATTACK This is when a UDP packet is sent which has a UDP datagram length of less the UDP header length. This may cause some applications to crash. UNDERSIZE-LEN ATTACK This is when a UDP packet is sent which has a UDP length field of less than 8 bytes. This may cause some applications to crash.
Chapter 30 ADP Figure 346 Profiles: Protocol Anomaly 460 ZyWALL USG 1000 User’s Guide
Chapter 30 ADP The following table describes the fields in this screen. Table 145 ADP > Profile > Protocol Anomaly LABEL DESCRIPTION Name This is the name of the profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 30 ADP 462 ZyWALL USG 1000 User’s Guide
CHAPTER 31 Content Filter Screens This chapter covers how to use the content filter feature to control web access. See Section 5.4.17 on page 120 for related information on these screens. 31.1 Content Filter Overview Content filter allows you to block certain web features, such as cookies, and/or block access to specific web sites. It can also block access to specific categories of web site content.
Chapter 31 Content Filter Screens 31.1.3 Content Filter Configuration Guidelines You must configure an address object, a schedule object and a filtering profile before you can set up a content filter policy. When the ZyWALL receives an HTTP request, the content filter searches for a policy that matches the source address and time (schedule). The content filter checks the policies in order (based on the policy numbers).
Chapter 31 Content Filter Screens Table 146 Anti-X > Content Filter > General (continued) LABEL DESCRIPTION Block web access when no policy is applied Select this check box to stop users from accessing the Internet by default when their attempted access does not match a content filter policy. # This column lists the index numbers of the content filter policies. Address A content filter policy applies to web access from the IP addresses listed here.
Chapter 31 Content Filter Screens Table 146 Anti-X > Content Filter > General (continued) LABEL DESCRIPTION Registration Status This read-only field displays the status of your content-filtering database service registration. Not Licensed displays if you have not successfully registered and activated the service. Expired displays if your subscription to the service has expired. Licensed displays if you have successfully registered the ZyWALL and activated the service.
Chapter 31 Content Filter Screens The following table describes the labels in this screen. Table 147 Anti-X > Content Filter > General > Add LABEL DESCRIPTION Schedule Select a schedule to define when to apply this content filter policy. You can define different policies for different time periods. For example, you could have one policy that blocks access to certain categories of web sites during working hours and another policy that allows access to certain categories after the work day is over.
Chapter 31 Content Filter Screens Table 148 Anti-X > Content Filter > Filter Profile (continued) LABEL DESCRIPTION Add Click the Add icon at the top of the column to create a new content filter profile at the end of the list. Click a content filter policy’s Add icon at the to create a new content filter policy below the current line. All other entries below the new entry are pushed down. Apply Click Apply to save your changes back to the ZyWALL.
Chapter 31 Content Filter Screens 31.6 Content Filter Categories Screen Click Anti-X > Content Filter > Filter Profile > Add or Edit to open the Categories screen. Use this screen to enable external database content filtering and select which web site categories to block and/or log. " You must register for external content filtering before you can use it. See Section 8.2 on page 166 for how to register. Do the following to view content filtering reports (see Chapter 32 on page 483 for details).
Chapter 31 Content Filter Screens Figure 351 Anti-X > Content Filter > Filter Profile > Add The following table describes the labels in this screen. Table 149 Anti-X > Content Filter > Filter Profile > Add LABEL DESCRIPTION Name Enter a descriptive name for this content filtering profile name. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 31 Content Filter Screens Table 149 Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Enable External Web Filter Service Enable external database content filtering to have the ZyWALL check an external database to find to which category a requested web page belongs. The ZyWALL then blocks or forwards access to the web page depending on the configuration of the rest of this page.
Chapter 31 Content Filter Screens Table 149 Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Intimate Apparel/Swimsuit Selecting this category excludes pages that contain images or offer the sale of swimsuits or intimate apparel or other types of suggestive clothing. It does not include pages selling undergarments as a subsection of other products offered. Nudity Selecting this category excludes pages containing nude or seminude depictions of the human body.
Chapter 31 Content Filter Screens Table 149 Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Arts/Entertainment Selecting this category excludes pages that promote and provide information about motion pictures, videos, television, music and programming guides, books, comics, movie theatres, galleries, artists or reviews on entertainment.
Chapter 31 Content Filter Screens Table 149 Anti-X > Content Filter > Filter Profile > Add (continued) 474 LABEL DESCRIPTION Political/Activist Groups Selecting this category excludes pages sponsored by or which provide information on political parties, special interest groups, or any organization that promotes change or reform in public policy, public opinion, social practice, or economic activities.
Chapter 31 Content Filter Screens Table 149 Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Open Image/Media Search Selecting this category excludes pages with image or video search capabilities which return graphical results (i.e. thumbnail pictures) that include potentially pornographic content along with non-pornographic content (as defined in the Pornography category). Sites that explicitly exclude offensive content are not included in this category.
Chapter 31 Content Filter Screens Table 149 Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Sexuality/Alternative Lifestyles Selecting this category excludes pages that provide information, promote, or cater to gays, lesbians, swingers, other sexual orientations or practices, or a particular fetish. This category does not include sites that are sexually gratuitous in nature which would typically fall under the Pornography category.
Chapter 31 Content Filter Screens Table 149 Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Test Against Local Cache Click this button to see the category recorded in the ZyWALL’s content filtering database for the web page you specified (if the database has an entry for it). Test Against Web Filter Server Click this button to see the category recorded in the external content filter server’s database for the web page you specified.
Chapter 31 Content Filter Screens Figure 352 Anti-X > Content Filter > Filter Profile > Customization The following table describes the labels in this screen. Table 150 Anti-X > Content Filter > Filter Profile > Customization LABEL DESCRIPTION Filter Profile Name Enter a descriptive name for this content filtering profile name. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 31 Content Filter Screens Table 150 Anti-X > Content Filter > Filter Profile > Customization (continued) LABEL DESCRIPTION Allow Web traffic for trusted web sites only When this box is selected, the ZyWALL blocks Web access to sites that are not on the Trusted Web Sites list. If they are chosen carefully, this is the most effective way to block objectionable material. Restricted Web Features Select the check box(es) to restrict a feature.
Chapter 31 Content Filter Screens Table 150 Anti-X > Content Filter > Filter Profile > Customization (continued) LABEL DESCRIPTION Blocked URL Keywords This section allows you to block Web sites with URLs that contain certain keywords in the domain name or IP address. Add Blocked URL Keyword Enter a keyword or a numerical IP address to block. You can also enter a numerical IP address. Use up to 63 case-insensitive characters (0-9a-zA-Z;/?:@&=+$\._!~*'()%,).
Chapter 31 Content Filter Screens Please see Section 32.2 on page 488 for how to submit a web site that has been incorrectly categorized. Figure 353 Anti-X > Content Filter > Cache The following table describes the labels in this screen. Table 151 Anti-X > Content Filter > Cache LABEL DESCRIPTION URL Cache Entry Flush Click this button to clear all web site addresses from the cache manually. Refresh Click this button to reload the list of content filter cache entries.
Chapter 31 Content Filter Screens Table 151 Anti-X > Content Filter > Cache (continued) LABEL DESCRIPTION Page x of x This is the number of the page of entries currently displayed and the total number of pages of entries. Type a page number to go to or use the arrows to navigate the pages of entries. # This is the index number of a categorized web site address record. Category This field shows whether access to the web site’s URL was blocked or allowed. Click the column heading to sort the entries.
CHAPTER 32 Content Filter Reports This chapter describes how to view content filtering reports after you have activated the category-based content filtering subscription service. See Chapter 8 on page 165 on how to create a myZyXEL.com account, register your device and activate the subscription services. 32.
Chapter 32 Content Filter Reports ZyWALL using the Rename button in the Service Management screen (see Figure 356 on page 484). Figure 355 myZyXEL.com: Welcome 4 In the Service Management screen click Content Filter in the Service Name field to open the Blue Coat login screen. Figure 356 myZyXEL.com: Service Management 5 Enter your ZyXEL device's MAC address (in lower case) in the Name field. You can find this MAC address in the Service Management screen (Figure 356 on page 484). Type your myZyXEL.
Chapter 32 Content Filter Reports 6 Click Submit. Figure 357 Blue Coat: Login 7 In the Web Filter Home screen, click the Reports tab. Figure 358 Blue Coat Content Filter Reports Main Screen 8 Select items under Global Reports or Single User Reports to view the corresponding reports.
Chapter 32 Content Filter Reports Figure 359 Blue Coat: Report Home 9 Select a time period in the Date Range field, either Allowed or Blocked in the Action Taken field and a category (or enter the user name if you want to view single user reports) and click Run Report.The screens vary according to the report type you selected in the Report Home screen. 10 A chart and/or list of requested web site categories display in the lower half of the screen.
Chapter 32 Content Filter Reports Figure 360 Global Report Screen Example 11 You can click a category in the Categories report or click URLs in the Report Home screen to see the URLs that were requested.
Chapter 32 Content Filter Reports Figure 361 Requested URLs Example 32.2 Web Site Submission You may find that a web site has not been accurately categorized or that a web site’s contents have changed and the content filtering category needs to be updated. Use the following procedure to submit the web site for review. 1 Log into the content filtering reports web site (see Section 32.1 on page 483).
Chapter 32 Content Filter Reports Figure 362 Web Page Review Process Screen 3 Type the web site’s URL in the field and click Submit to have the web site reviewed.
Chapter 32 Content Filter Reports 490 ZyWALL USG 1000 User’s Guide
P ART V Device HA & Objects Device HA (493) User/Group (503) Addresses (515) Services (521) Schedules (527) AAA Server (531) Authentication Objects (541) Certificates (545) ISP Accounts (563) SSL Application (567) 491
CHAPTER 33 Device HA Use device HA and Virtual Router Redundancy Protocol (VRRP) to increase network reliability. See Section 5.4.8 on page 117 for related information on these screens. 33.1 Virtual Router Redundancy Protocol (VRRP) Overview Every computer on a network may send packets to a default gateway, which can become a single point of failure. Virtual Router Redundancy Protocol (VRRP) allows you to create redundant backup gateways to ensure that the default gateway is always available.
Chapter 33 Device HA " Every router in a virtual router must use the same advertisement interval. If Router A becomes unavailable, it stops sending messages to Router B. Router B detects this and assumes the role of the master router. This is illustrated below. Figure 364 Example: VRRP, Master Becomes Unavailable Router B is now using the IP address of the default gateway, and it is forwarding packets for the network. The loss of Router A has no effect on the network.
Chapter 33 Device HA 33.1.1 Additional VRRP Notes • It is possible to set up two virtual routers so that they back up each other. • VRRP uses IP protocol 112. 33.2 VRRP Group Overview In the ZyWALL, you should create a VRRP group to add one of its interfaces to a virtual router. You can add any Ethernet or VLAN interface with a static IP address. You do not configure VRRP groups for virtual interfaces. " You can only use interfaces that have static IP addresses.
Chapter 33 Device HA 33.2.1 Link Monitoring and Remote Management With link monitoring enabled, a backup ZyWALL that takes over for an unavailable master ZyWALL takes over all of the master ZyWALL’s static IP addresses. This way the backup ZyWALL takes over all of the master ZyWALL’s functions. However, this also means you can no longer access the original master ZyWALL through one of its static IP addresses (because the backup ZyWALL now uses this address).
Chapter 33 Device HA Figure 366 Device HA > VRRP Group The following table describes the labels in this screen. See Section 33.5 on page 498 for more information as well. Table 152 Device HA > VRRP Group LABEL DESCRIPTION Refresh Click this button to update the information in this screen. # This field is a sequential value, and it is not associated with a specific VRRP group. Name This field displays the name of the VRRP group. VRID This field displays the virtual router ID number.
Chapter 33 Device HA Table 152 Device HA > VRRP Group (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 33.5 VRRP Group Add/Edit The VRRP Group Add/Edit screen allows you to add VRRP groups to the ZyWALL or to edit the configuration of an existing VRRP group. • You can only use interfaces that have static IP addresses.
Chapter 33 Device HA Table 153 Device HA > VRRP Group > Edit (continued) LABEL DESCRIPTION VRID Type the virtual router ID number. Description Type the description of the VRRP group. This field is only for your reference. It may be up to sixty printable ASCII characters long. VRRP Interface Select the interface in this device that is part of the virtual router. You can only select interfaces that have static IP addresses. Role Select the role that you want the interface plays in the virtual router.
Chapter 33 Device HA 33.6 Synchronization Overview In a virtual router, backup routers do not automatically get configuration updates from the master router. In this case, the master ZyWALL can send these updates to backup ZyWALLs. This is called synchronization. During synchronization, the master ZyWALL sends the following information to the backup ZyWALL. • • • • • Startup configuration file (startup-config.
Chapter 33 Device HA " You must subscribe to services on the backup ZyWALL before synchronizing it with the master ZyWALL. 33.6.2 Synchronize Screen Use this screen if you want the ZyWALL to get or to send updated IDP signatures, and configuration information in the virtual router. " You can only set up synchronization with other ZyWALLs of the same model running the same firmware version. To access this screen, click Network > Device HA > Synchronize.
Chapter 33 Device HA Table 154 Network > Device HA > Synchronize (continued) LABEL DESCRIPTION Sync. Now Click this button to get updated certificates, AV signatures, IDP and application patrol signatures, system protect signatures, and configuration information from the specified ZyWALL router. Note: If the new configuration is different from the existing one on this backup ZyWALL, this backup ZyWALL applies the entire configuration.
CHAPTER 34 User/Group This chapter describes how to set up user accounts, user groups, and user settings for the ZyWALL. You can also set up rules that control when users have to log in to the ZyWALL before the ZyWALL routes traffic for them. See Section 5.5.1 on page 122 for related information on these screens. 34.1 User Account Overview A user account defines the privileges of a user logged into the ZyWALL.
Chapter 34 User/Group 34.1.2 Ext-User Accounts Set up an Ext-User account if the user is authenticated by an external server and you want to set up specific policies for this user in the ZyWALL. If you do not want to set up policies for this user, you do not have to set up an Ext-User account. Ext-User users should be authenticated by an external server, such as LDAP or RADIUS. If the ZyWALL tries to use the local database to authenticate an Ext-User, the authentication attempt always fails.
Chapter 34 User/Group Figure 370 RADIUS Example: Keywords for User Attributes type=user;leaseTime=222;reauthTime=222 34.1.2.2 Creating a Large Number of Ext-User Accounts If you plan to create a large number of Ext-User accounts, you might use CLI commands, instead of the web configurator, to create the accounts. Extract the user names from the LDAP or RADIUS server, and create a shell script that creates the user accounts. See Chapter 45 on page 615 for more information about shell scripts. 34.1.
Chapter 34 User/Group " This works with HTTP traffic only. The ZyWALL does not force users to log in before it routes other kinds of traffic. The ZyWALL does not automatically route the request that prompted the login, however, so users have to make this request again. 34.2 User Summary The User screen provides a summary of all user accounts. To access this screen, login to the web configurator, and click User/Group. Figure 371 User/Group The following table describes the labels in this screen.
Chapter 34 User/Group Figure 372 User/Group > User > Edit The following table describes the labels in this screen. Table 158 User/Group > User > Edit LABEL DESCRIPTION User Name Type the user name for this user account. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. User names have to be different than user group names, and some words are reserved. See Section 34.2.1.1 on page 508.
Chapter 34 User/Group 34.2.1.1 Rules for User Names Enter a user name from 1 to 31 characters. The user name can only contain the following characters: • Alphanumeric A-z 0-9 (there is no unicode support) • _ [underscores] • - [dashes] The first character must be alphabetical (A-Z a-z), an underscore (_), or a dash (-). Other limitations on user names are: • User names are case-sensitive.
Chapter 34 User/Group Table 160 User/Group > Group (continued) LABEL DESCRIPTION Member This field lists the members in the user group. Each member is separated by a comma. Add icon This column provides icons to add, edit, and remove user groups. To add a user group, click the Add icon at the top of the column. The Group Add/ Edit screen appears. To edit a user group, click the Edit icon next to the user group. The Group Add/ Edit screen appears.
Chapter 34 User/Group 34.4 Setting Screen The Setting screen controls default settings, login settings, lockout settings, and other user settings for the ZyWALL. You can also use this screen to specify when users must log in to the ZyWALL before it routes traffic for them. To access this screen, login to the web configurator, and click User/Group > Setting. Figure 375 User/Group > Setting The following table describes the labels in this screen.
Chapter 34 User/Group Table 162 User/Group > Setting (continued) LABEL DESCRIPTION User Logon Setting Limit ... for administratio n account Select this check box if you want to set a limit on the number of simultaneous logins by admin users. If you do not select this, admin users can login as many times as they want at the same time using the same or different IP addresses. Maximum number per administratio n account This field is effective when Limit ... for administration account is checked.
Chapter 34 User/Group Table 162 User/Group > Setting (continued) LABEL DESCRIPTION Page x of x This is the number of the page of entries currently displayed and the total number of pages of entries. Type a page number to go to or use the arrows to navigate the pages of entries. # This field is a sequential value, and it is not associated with a specific condition. Schedule This field displays the schedule object that specifies when this condition applies.
Chapter 34 User/Group The following table describes the labels in this screen. Table 163 User/Group > Setting > Force User Authentication Policy > Add/Edit LABEL DESCRIPTION Enable Select this if you want this condition to be active. Description Enter a description for this condition. It can be up to 60 printable ASCII characters long. Authentication Select whether users must log in (force) or whether users do not have to log in (skip) when this condition is checked and satisfied.
Chapter 34 User/Group The following table describes the labels in this screen. Table 164 Web Configurator for Non-Admin Users 514 LABEL DESCRIPTION User-defined lease time (max ... minutes) Access users can specify a lease time shorter than or equal to the one that you specified. The default value is the lease time that you specified. Renew Access users can click this button to reset the lease time, the amount of time remaining before the ZyWALL automatically logs them out.
CHAPTER 35 Addresses This chapter describes how to set up addresses and address groups for the ZyWALL. See Section 5.5 on page 122 for related information on these screens. 35.1 Addresses Overview Address objects can represent a single IP address or a range of IP addresses. Address groups are composed of address objects and other address groups. Address objects and address groups are used in dynamic routes, firewall rules, application patrol, content filtering, and VPN connection policies.
Chapter 35 Addresses Figure 378 Object > Address > Address The following table describes the labels in this screen. See Section 35.2.2 on page 516 for more information as well. Table 165 Object > Address > Address LABEL DESCRIPTION # This field is a sequential value, and it is not associated with a specific address. Name This field displays the name of each address. Type This field displays the type of each address. Address This field displays the IP addresses represented by each address object.
Chapter 35 Addresses The following table describes the labels in this screen. Table 166 Object > Address > Address > Edit LABEL DESCRIPTION Name Type the name used to refer to the address. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Address Type Select the type of address you want to create. Choices are: HOST, RANGE, and SUBNET. IP Address This field is only available if the Address Type is HOST.
Chapter 35 Addresses The following table describes the labels in this screen. See Section 35.3.2 on page 518 for more information as well. Table 167 Object > Address > Address Group LABEL DESCRIPTION # This field is a sequential value, and it is not associated with a specific address group. Name This field displays the name of each address group. Description This field displays the description of each address group, if any.
Chapter 35 Addresses Table 168 Object > Address > Address Group > Add (continued) LABEL DESCRIPTION Available This field displays the names of the address and address group objects that can be added to the address group. Select address and address group objects that you want to be members of this group and click the right arrow to add them to the member list. Member This field displays the names of the address and address group objects that have been added to the address group.
Chapter 35 Addresses 520 ZyWALL USG 1000 User’s Guide
CHAPTER 36 Services Use service objects to define TCP applications, UDP applications, and ICMP messages. You can also create service groups to refer to multiple service objects in other features. See Section 5.5 on page 122 for related information on these screens. 36.1 Services Overview See Appendix C on page 703 for a list of commonly-used services. 36.1.1 IP Protocols IP protocols are based on the eight-bit protocol field in the IP header.
Chapter 36 Services • UDP applications • ICMP messages • user-defined services (for other types of IP protocols) These objects are used in policy routes, firewall rules, and IDP profiles. Use service groups when you want to create the same rule for several services, instead of creating separate rules for each service. Service groups may consist of services and other service groups. The sequence of members in the service group is not important. 36.
Chapter 36 Services Table 169 Object > Service > Service (continued) LABEL DESCRIPTION Content This field displays a description of each service. Add icon This column provides icons to add, edit, and remove services. To add a service, click the Add icon at the top of the column. The Service Add/ Edit screen appears. To edit a service, click the Edit icon next to the service. The Service Add/Edit screen appears. To delete a service, click the Remove icon next to the service.
Chapter 36 Services 36.3 Service Group Summary Screen The Service Group summary screen provides a summary of all service groups. In addition, this screen allows you to add, edit, and remove service groups. To access this screen, log in to the web configurator, and click Object > Service > Service Group. Figure 384 Object > Service > Service Group The following table describes the labels in this screen. See Section 36.3.1 on page 524 for more information as well.
Chapter 36 Services Figure 385 Object > Service > Service Group > Edit The following table describes the labels in this screen. Table 172 Object > Service > Service Group > Edit LABEL DESCRIPTION Name Enter the name of the service group. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Description Enter a description of the service group, if any. You can use up to 60 printable ASCII characters.
Chapter 36 Services 526 ZyWALL USG 1000 User’s Guide
CHAPTER 37 Schedules Use schedules to set up one-time and recurring schedules for policy routes, firewall rules, application patrol, and content filtering. See Section 5.5 on page 122 for related information on these screens. 37.1 Schedule Overview The ZyWALL supports two types of schedules: one-time and recurring. One-time schedules are effective only once, while recurring schedules usually repeat. Both types of schedules are based on the current date and time in the ZyWALL. See Section 43.
Chapter 37 Schedules Figure 386 Object > Schedule The following table describes the labels in this screen. See Section 37.2.2 on page 528 and Section 37.2.3 on page 529 for more information as well. Table 173 Object > Schedule LABEL DESCRIPTION One Time # This field is a sequential value, and it is not associated with a specific schedule. Name This field displays the name of the schedule, which is used to refer to the schedule.
Chapter 37 Schedules Figure 387 Object > Schedule > Edit (One Time) The following table describes the labels in this screen. Table 174 Object > Schedule > Edit (One Time) LABEL DESCRIPTION Configuration Name Type the name used to refer to the one-time schedule. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Date Time Start Type the year, month, day, hour, and minute when the schedule begins.
Chapter 37 Schedules Figure 388 Object > Schedule > Edit (Recurring) The Year, Month, and Day columns are not used in recurring schedules and are disabled in this screen. The following table describes the remaining labels in this screen. Table 175 Object > Schedule > Edit (Recurring) LABEL DESCRIPTION Configuration Name Type the name used to refer to the recurring schedule. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number.
CHAPTER 38 AAA Server This chapter introduces and shows you how to configure the ZyWALL to use external authentication servers. 38.1 AAA Server Overview You can use an AAA (Authentication, Authorization, Accounting) server to provide access control to your network. The following lists the types of authentication server the ZyWALL supports.
Chapter 38 AAA Server 5 Configure the ASAS as a RADIUS server in the ZyWALL’s Object > AAA Server screens. 6 Give the OTP tokens to (local or remote) users. 38.1.2 User Authentication Method You can select to authenticate users using the local user database and/or a specified authentication server. By default, user accounts created and stored on the ZyWALL are authenticated locally. 38.
Chapter 38 AAA Server Figure 390 Basic Directory Structure Sprint Sales RD3 US UPS QA CSO Root Sales Japan Countries (c) NEC RD Organizations (o) Organization Units (ou) Unique Common Name (cn) 38.2.2 Distinguished Name (DN) A DN uniquely identifies an entry in a directory. A DN consists of attribute-value pairs separated by commas. The leftmost attribute is the Relative Distinguished Name (RDN). This provides a unique name for entries that have the same “parent DN” (“cn=domain1.
Chapter 38 AAA Server Figure 391 Object > AAA Server > Active Directory (or LDAP) > Default The following table describes the labels in this screen. Table 176 Object > AAA Server > Active Directory (or LDAP) > Default LABEL DESCRIPTION Host Enter the IP address (in dotted decimal notation) or the fully-qualified domain name (up to 63 alphanumerical characters) of an AD or LDAP server. Port Specify the port number on the AD or LDAP server to which the ZyWALL sends authentication requests.
Chapter 38 AAA Server 1 Click Object > AAA Server > Active Directory (or LDAP) > Group to display the screen. Figure 392 Object > AAA Server > Active Directory (or LDAP) > Group The following table describes the labels in this screen. Table 177 Object > AAA Server > Active Directory (or LDAP) > Group LABEL DESCRIPTION # This field displays the index number. Group Name This field displays the descriptive name for identification purposes. Add icon Click Add to add a new entry.
Chapter 38 AAA Server The following table describes the labels in this screen. Table 178 Object > AAA Server > Active Directory (or LDAP) > Group > Add LABEL DESCRIPTION Configuration All AD or LDAP servers in a group share the same settings in the fields below. Name Enter a descriptive name (up to 63 alphanumerical characters). for identification purposes. Port Specify the port number on the LDAP server(s) to which the ZyWALL sends authentication requests. Enter a number between 1 and 65535.
Chapter 38 AAA Server Figure 394 RADIUS Server Network Example 38.5 Configuring a Default RADIUS Server To configure the default external RADIUS server to use for user authentication, click Object > AAA Server > RADIUS to display the screen as shown. Figure 395 Object > AAA Server > RADIUS > Default The following table describes the labels in this screen.
Chapter 38 AAA Server 38.6 Configuring a Group of RADIUS Servers You can configure a group of RADIUS servers in the RADIUS > Group screen. This is useful if you have more than one authentication server for user authentication in a network. 1 Click Object > AAA Server > RADIUS > Group to display the screen. Figure 396 Object > AAA Server > RADIUS > Group The following table describes the labels in this screen.
Chapter 38 AAA Server The following table describes the labels in this screen. Table 181 Object > AAA Server > RADIUS > Group > Add LABEL DESCRIPTION Configuration All RADIUS servers in a group share the same settings in the fields below. Name Enter a descriptive name (up to 63 alphanumeric characters) for identification purposes. Key Enter a password (up to 15 alphanumeric characters) as the key to be shared between the external authentication server and the ZyWALL.
Chapter 38 AAA Server 540 ZyWALL USG 1000 User’s Guide
CHAPTER 39 Authentication Objects This chapter shows you how to select different authentication methods for user authentication using the AAA servers or the internal user database. 39.1 Authentication Objects Overview After you have created the AAA server objects in the AAA Server screens, you can specify the authentication objects (containing the AAA server information) that the ZyWALL uses to authenticate users (using VPN or managing through HTTP/HTTPS).
Chapter 39 Authentication Objects 39.3 Creating an Authentication Object Follow the steps below to create an authentication object. 1 Click Object > Auth. Method. 2 Click Add. 3 Specify a descriptive name for identification purposes in the Name field. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. For example, “My_Device”. 4 Click Add to insert an authentication method in the table.
Chapter 39 Authentication Objects The following table describes the labels in this screen. Table 183 Object > Auth. Method > Add LABEL DESCRIPTION Name Specify a descriptive name for identification purposes. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. For example, “My_Device”. Method List Select a server object from the drop-down list box.
Chapter 39 Authentication Objects Figure 400 Example: Using Authentication Method in VPN 544 ZyWALL USG 1000 User’s Guide
CHAPTER 40 Certificates This chapter gives background information about public-key certificates and explains how to use the Certificates screens. See Section 5.5 on page 122 for related information on these screens. 40.1 Certificates Overview The ZyWALL can use certificates (also called digital IDs) to authenticate users. Certificates are based on public-private key pairs. A certificate contains the certificate owner’s identity and public key.
Chapter 40 Certificates Certification authorities maintain directory servers with databases of valid and revoked certificates. A directory of certificates that have been revoked before the scheduled expiration is called a CRL (Certificate Revocation List). The ZyWALL can check a peer’s certificate against a directory server’s list of revoked certificates. The framework of servers, software, procedures and policies that handles keys is called PKI (public-key infrastructure). 40.1.
Chapter 40 Certificates " Be careful to not convert a binary file to text during the transfer process. It is easy for this to occur since many programs use text files by default. 40.4 Certificate Configuration Screens Summary This section summarizes how to manage certificates on the ZyWALL. Use the My Certificate screens to generate and export self-signed certificates or certification requests and import the ZyWALL’s CA-signed certificates.
Chapter 40 Certificates Figure 402 Certificate Details 4 Use a secure method to verify that the certificate owner has the same information in the Thumbprint Algorithm and Thumbprint fields. The secure method may very based on your situation. Possible examples would be over the telephone or through an HTTPS connection. 40.6 My Certificates Screen Click Object > Certificate > My Certificates to open the My Certificates screen. This is the ZyWALL’s summary list of certificates and certification requests.
Chapter 40 Certificates The following table describes the labels in this screen. Table 184 Object > Certificate > My Certificates LABEL DESCRIPTION PKI Storage Space in Use This bar displays the percentage of the ZyWALL’s PKI storage space that is currently in use. When the storage space is almost full, you should consider deleting expired or unnecessary certificates before adding more certificates. # This field displays the certificate index number. The certificates are listed in alphabetical order.
Chapter 40 Certificates Figure 404 Object > Certificate > My Certificates > Add The following table describes the labels in this screen. Table 185 Object > Certificate > My Certificates > Add 550 LABEL DESCRIPTION Name Type a name to identify this certificate. You can use up to 31 alphanumeric and ;‘~!@#$%^&()_+[]{}’,.=- characters. Subject Information Use these fields to record information that identifies the owner of the certificate.
Chapter 40 Certificates Table 185 Object > Certificate > My Certificates > Add (continued) LABEL DESCRIPTION Organization Identify the company or group to which the certificate owner belongs. You can use up to 31 characters. You can use alphanumeric characters, the hyphen and the underscore. Country Identify the nation where the certificate owner is located. You can use up to 31 characters. You can use alphanumeric characters, the hyphen and the underscore.
Chapter 40 Certificates Table 185 Object > Certificate > My Certificates > Add (continued) LABEL DESCRIPTION Request Authentication When you select Create a certification request and enroll for a certificate immediately online, the certification authority may want you to include a reference number and key to identify you when you send a certification request. Fill in both the Reference Number and the Key fields if your certification authority uses CMP enrollment protocol.
Chapter 40 Certificates Figure 405 Object > Certificate > My Certificates > Edit The following table describes the labels in this screen. Table 186 Object > Certificate > My Certificates > Edit LABEL DESCRIPTION Name This field displays the identifying name of this certificate. You can use up to 31 alphanumeric and ;‘~!@#$%^&()_+[]{}’,.=- characters. Certification Path This field displays for a certificate, not a certification request.
Chapter 40 Certificates Table 186 Object > Certificate > My Certificates > Edit 554 LABEL DESCRIPTION Type This field displays general information about the certificate. CA-signed means that a Certification Authority signed the certificate. Self-signed means that the certificate’s owner signed the certificate (not a certification authority). “X.509” means that this certificate was created and signed according to the ITU-T X.509 recommendation that defines the formats for public-key certificates.
Chapter 40 Certificates Table 186 Object > Certificate > My Certificates > Edit LABEL DESCRIPTION Export This button displays for a certification request. Use this button to save a copy of the request without its private key. Click this button and then Save in the File Download screen. The Save As screen opens, browse to the location that you want to use and click Save. Export Certificate Only Use this button to save a copy of the certificate without its private key.
Chapter 40 Certificates The following table describes the labels in this screen. Table 187 Object > Certificate > My Certificates > Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it. You cannot import a certificate with the same name as a certificate that is already in the ZyWALL. Browse Click Browse to find the certificate file you want to upload.
Chapter 40 Certificates Table 188 Object > Certificate > Trusted Certificates (continued) LABEL DESCRIPTION Name This field displays the name used to identify this certificate. Subject This field displays identifying information about the certificate’s owner, such as CN (Common Name), OU (Organizational Unit or department), O (Organization or company) and C (Country). It is recommended that each certificate have unique subject information.
Chapter 40 Certificates Figure 408 Object > Certificate > Trusted Certificates > Edit The following table describes the labels in this screen. Table 189 Object > Certificate > Trusted Certificates > Edit 558 LABEL DESCRIPTION Name This field displays the identifying name of this certificate. You can change the name. You can use up to 31 alphanumeric and ;‘~!@#$%^&()_+[]{}’,.=characters.
Chapter 40 Certificates Table 189 Object > Certificate > Trusted Certificates > Edit (continued) LABEL DESCRIPTION Refresh Click Refresh to display the certification path. Enable X.509v3 CRL Distribution Points and OCSP checking Select this check box to have the ZyWALL check incoming certificates that are signed by this certificate against a Certificate Revocation List (CRL) or an OCSP server. You also need to configure the OSCP or LDAP server details.
Chapter 40 Certificates Table 189 Object > Certificate > Trusted Certificates > Edit (continued) LABEL DESCRIPTION Valid From This field displays the date that the certificate becomes applicable. The text displays in red and includes a Not Yet Valid! message if the certificate has not yet become applicable. Valid To This field displays the date that the certificate expires.
Chapter 40 Certificates Figure 409 Object > Certificate > Trusted Certificates > Import The following table describes the labels in this screen. Table 190 Object > Certificate > Trusted Certificates > Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it. You cannot import a certificate with the same name as a certificate that is already in the ZyWALL. Browse Click Browse to find the certificate file you want to upload.
Chapter 40 Certificates 562 ZyWALL USG 1000 User’s Guide
CHAPTER 41 ISP Accounts Use ISP accounts to manage Internet Service Provider (ISP) account information for PPPoE/ PPTP interfaces. See Section 5.5 on page 122 for related information on these screens. 41.1 ISP Accounts Overview An ISP account is a profile of settings for Internet access using PPPoE or PPTP. See Section 10.6 on page 210 for information about PPPoE/PPTP interfaces. 41.2 ISP Account Summary This screen provides a summary of ISP accounts in the ZyWALL.
Chapter 41 ISP Accounts Table 191 Object > ISP Account (continued) LABEL DESCRIPTION User Name This field displays the user name of the ISP account. Add icon This column provides icons to add, edit, and remove ISP accounts. To add information about a new ISP account, click the Add icon at the top of the column. The ISP Account Edit screen appears. To edit information about an existing account, click the Edit icon next to the ISP account. The ISP Account Edit screen appears.
Chapter 41 ISP Accounts Table 192 Object > ISP Account > Edit (continued) LABEL DESCRIPTION Encryption Method This field is available if this ISP account uses the PPTP protocol. Use the dropdown list box to select the type of Microsoft Point-to-Point Encryption (MPPE). Options are: nomppe - This ISP account does not use MPPE. mppe-40 - This ISP account uses 40-bit MPPE. mppe-128 - This ISP account uses 128-bit MMPE.
Chapter 41 ISP Accounts 566 ZyWALL USG 1000 User’s Guide
CHAPTER 42 SSL Application This chapter describes how to configure SSL application objects for use in SSL VPN. 42.1 SSL Application Overview Configure an SSL application object to specify a service and a corresponding IP address of the server on the local network. You can apply one or more SSL application objects in the VPN > SSL VPN screen for a user account/user group. 42.1.1 Application Types The following lists the types of SSL applications you can configure on the ZyWALL.
Chapter 42 SSL Application The following table describes the labels in this screen. Table 193 Object > SSL Application LABEL DESCRIPTION # This field displays the index number. Name This field displays the name of the object. Address This field displays the IP address/URL of the application server or the location of a file share. Type This field display the application type. Add icon This column provides icons to add, edit, and remove SSL application objects.
Chapter 42 SSL Application The following table describes the labels in this screen. Table 194 Object > SSL Application > Add/Edit: Web Application LABEL DESCRIPTION Object Type Select Web Application from the drop-down list box. Web Application Name Enter a descriptive name to identify this object. You can enter up to 31 characters (“09”, “a-z”, “A-Z”, “-” and “_”). No spaces are allowed. Note: If there is any space in the name, a warning screen displays when you click Apply.
Chapter 42 SSL Application 7 Click Apply to save the settings. The configuration screen should look similar to the following figure. Figure 414 Example: SSL Application: Specifying a Web Site for Access 42.3.3 Configuring File Sharing You can specify the name of a folder on a file server (Linux or Windows) which remote users can access. Remote users can access files using a standard web browser and files are displayed as links on the screen.
Chapter 42 SSL Application Table 195 Object > SSL Application > Add/Edit: Web Application " LABEL DESCRIPTION Shared Path Specify the IP address, domain name or NetBIOS name (computer name) of the file server and the name of the share to which you want to allow user access. Enter the path in one of the following formats.
Chapter 42 SSL Application 572 ZyWALL USG 1000 User’s Guide
P ART VI System System (575) Service Control (587) 573
CHAPTER 43 System This chapter provides information on the general system screens. See Chapter 44 on page 587 for details on the system screens that control service access. 43.1 System Overview The system screens can help you configure general ZyWALL information, the system time and the console port connection speed for a terminal emulation program. The screens also allow you to configure DNS settings and determine which services/protocols can access which ZyWALL zones (if any) from which computers. 43.
Chapter 43 System 43.3 Time and Date This section shows you how: 1 To manually set the ZyWALL date and time. 2 To get the ZyWALL date and time from a time server. For effective scheduling and logging, the ZyWALL system time must be accurate. The ZyWALL’s Real Time Chip (RTC) keeps track of the time and date. There is also a software mechanism to set the time manually or get the current time and date from an external server.
Chapter 43 System Table 197 System > Date and Time (continued) LABEL DESCRIPTION Manual Select this radio button to enter the time and date manually. If you configure a new time and date, time zone and daylight saving at the same time, the time zone and daylight saving will affect the new time and date you entered. When you enter the time settings manually, the ZyWALL uses the new setting once you click Apply.
Chapter 43 System Table 197 System > Date and Time (continued) LABEL DESCRIPTION End Date Configure the day and time when Daylight Saving Time ends if you selected Enable Daylight Saving. The at field uses the 24 hour format. Here are a couple of examples: Daylight Saving Time ends in the United States on the first Sunday of November. Each time zone in the United States stops using Daylight Saving Time at 2 A.M. local time.
Chapter 43 System Figure 418 Synchronization in Process The Current Time and Current Date fields will display the appropriate settings if the synchronization is successful. If the synchronization was not successful, a log displays in the View Log screen. Try reconfiguring the Date/Time screen. To manually set the ZyWALL date and time. 1 2 3 4 5 6 Click System > Date/Time. Select Manual under Time and Date Setup. Enter the ZyWALL’s time in the New Time field. Enter the ZyWALL’s date in the New Date field.
Chapter 43 System Figure 419 System > Console Port Speed The following table describes the labels in this screen. Table 199 System > Console Port Speed LABEL DESCRIPTION Configuration Console Port Speed Use the drop-down list box to change the speed of the console port. Your ZyWALL supports 9600, 19200, 38400, 57600, and 115200 bps (default) for the console port.
Chapter 43 System Figure 420 System > DNS The following table describes the labels in this screen. Table 200 System > DNS LABEL DESCRIPTION Address/PTR Record This record specifies the mapping of a fully qualified domain name (FQDN) to an IP address. An FQDN consists of a host and domain name. For example, www.zyxel.com.tw is a fully qualified domain name, where “www” is the host, “zyxel” is the third-level domain, “com” is the second-level domain, and “tw” is the top level domain.
Chapter 43 System Table 200 System > DNS (continued) 582 LABEL DESCRIPTION From This displays whether the DNS server IP address is assigned by the ISP dynamically through a specified interface or configured manually. DNS Server This is the IP address of a DNS server. This field displays N/A if you have the ZyWALL get a DNS server IP address from the ISP dynamically but the specified interface is not active.
Chapter 43 System 43.5.4 Address Record An address record contains the mapping of a fully qualified domain name (FQDN) to an IP address. An FQDN consists of a host and domain name. For example, www.zyxel.com is a fully qualified domain name, where “www” is the host, “zyxel” is the second-level domain, and “com” is the top level domain. mail.myZyXEL.com.tw is also a FQDN, where “mail” is the host, “myZyXEL” is the third-level domain, “com” is the second-level domain, and “tw” is the top level domain.
Chapter 43 System 43.5.7 Domain Zone Forwarder A domain zone forwarder contains a DNS server’s IP address. The ZyWALL can query the DNS server to resolve domain zones for features like VPN, DDNS and the time server. A domain zone is a fully qualified domain name without the host. For example, zyxel.com.tw is the domain zone for the www.zyxel.com.tw fully qualified domain name. 43.5.8 Adding a Domain Zone Forwarder Click the Add icon in the Domain Zone Forwarder table to add a domain zone forwarder record.
Chapter 43 System 43.5.9 MX Record A MX (Mail eXchange) record indicates which host is responsible for the mail for a particular domain, that is, controls where mail is sent for that domain. If you do not configure proper MX records for your domain or other domain, external e-mail from other mail servers will not be able to be delivered to your mail server and vice versa. Each host or domain can have only one MX record, that is, one domain is mapping to one host. 43.5.
Chapter 43 System The following table describes the labels in this screen. Table 204 System > DNS > Service Control Rule Edit LABEL DESCRIPTION Address Object Select ALL to allow or deny any computer to send DNS queries to the ZyWALL. Select a predefined address object to just allow or deny the computer with the IP address that you specified to send DNS queries to the ZyWALL. Zone Select ALL to allow or prevent DNS queries through any zones.
CHAPTER 44 Service Control This chapter covers controlling access to the ZyWALL. See Chapter 43 on page 575 for the general system configuration screens. 44.1 Service Control Overview Use this chapter to control which services can access the ZyWALL. The following figure shows secure and insecure management of the ZyWALL coming in from the WAN. HTTPS and SSH access are secure. HTTP, Telnet, and dial-in management access are not secure.
Chapter 44 Service Control 44.1.1 Service Access Limitations A service cannot be used to access the ZyWALL when: 1 You have disabled that service in the corresponding screen. 2 The allowed IP address (address object) in the Service Control table does not match the client IP address (the ZyWALL disallows the session). 3 The IP address (address object) in the Service Control table is not in the allowed zone or the action is set to Deny. 4 There is a firewall rule that blocks it. 44.1.
Chapter 44 Service Control Figure 427 HTTP/HTTPS Implementation " If you disable HTTP in the WWW screen, then the ZyWALL blocks all HTTP connection attempts. 44.3 Configuring WWW Click System > WWW to open the WWW screen. Use this screen to specify from which zones you can access the ZyWALL using HTTP or HTTPS. You can also specify which IP addresses the access can come from. " Admin Service Control deals with management access (to the web configurator).
Chapter 44 Service Control Figure 428 System > WWW The following table describes the labels in this screen. Table 206 System > WWW LABEL DESCRIPTION HTTPS 590 Enable Select the check box to allow or disallow the computer with the IP address that matches the IP address(es) in the Service Control table to access the ZyWALL web configurator using secure HTTPs connections. Server Port The HTTPS server listens on port 443 by default.
Chapter 44 Service Control Table 206 System > WWW (continued) LABEL DESCRIPTION Admin/User Service Control Admin Service Control specifies from which zones an administrator can use HTTPS to manage the ZyWALL (using the web configurator). You can also specify the IP addresses from which the administrators can manage the ZyWALL. User Service Control specifies from which zones a user can use HTTPS to log into the ZyWALL (to log into SSL VPN for example).
Chapter 44 Service Control Table 206 System > WWW (continued) LABEL DESCRIPTION Client Authentication Method Select a method the HTTPS or HTTP server uses to authenticate a client. You must have configured the authentication methods in the Auth. method screen. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 44.
Chapter 44 Service Control 44.5.1 Internet Explorer Warning Messages When you attempt to access the ZyWALL HTTPS server, a Windows dialog box pops up asking if you trust the server certificate. Click View Certificate if you want to verify that the certificate is from the ZyWALL. You see the following Security Alert screen in Internet Explorer. Select Yes to proceed to the web configurator login screen; if you select No, then web configurator access is blocked.
Chapter 44 Service Control Figure 431 Security Certificate 1 (Netscape) Figure 432 Security Certificate 2 (Netscape) 44.5.3 Avoiding Browser Warning Messages The following describes the main reasons that your browser displays warnings about the ZyWALL’s HTTPS server certificate and what you can do to avoid seeing the warnings. • The issuing certificate authority of the ZyWALL’s HTTPS server certificate is not one of the browser’s trusted certificate authorities.
Chapter 44 Service Control 44.5.4 Login Screen After you accept the certificate, the ZyWALL login screen appears. The lock displayed in the bottom of the browser status bar denotes a secure connection. Figure 433 Login Screen (Internet Explorer) 44.5.5 Enrolling and Importing SSL Client Certificates The SSL client needs a certificate if Authenticate Client Certificates is selected on the ZyWALL.
Chapter 44 Service Control Figure 435 CA Certificate Example 2 Click Install Certificate and follow the wizard as shown earlier in this appendix. 44.5.5.2 Installing Your Personal Certificate(s) You need a password in advance. The CA may issue the password or you may have to specify it during the enrollment. Double-click the personal certificate given to you by the CA to produce a screen similar to the one shown next 1 Click Next to begin the wizard.
Chapter 44 Service Control 2 The file name and path of the certificate you double-clicked should automatically appear in the File name text box. Click Browse if you wish to import a different certificate. Figure 437 Personal Certificate Import Wizard 2 3 Enter the password given to you by the CA.
Chapter 44 Service Control Figure 439 Personal Certificate Import Wizard 4 5 Click Finish to complete the wizard and begin the import process. Figure 440 Personal Certificate Import Wizard 5 6 You should see the following screen when the certificate is correctly installed on your computer.
Chapter 44 Service Control 44.5.6 Using a Certificate When Accessing the ZyWALL Example Use the following procedure to access the ZyWALL via HTTPS. 1 Enter ‘https://ZyWALL IP Address/ in your browser’s web address field. Figure 442 Access the ZyWALL Via HTTPS 2 When Authenticate Client Certificates is selected on the ZyWALL, the following screen asks you to select a personal certificate to send to the ZyWALL. This screen displays even if you only have a single certificate as in the example.
Chapter 44 Service Control 44.6 SSH You can use SSH (Secure SHell) to securely access the ZyWALL’s command line interface. Specify which zones allow SSH access and from which IP address the access can come. SSH is a secure communication protocol that combines authentication and data encryption to provide secure encrypted communication between two hosts over an unsecured network.
Chapter 44 Service Control The client automatically saves any new server public keys. In subsequent connections, the server public key is checked against the saved version on the client computer. 2 Encryption Method Once the identification is verified, both the client and server must agree on the type of encryption method to use. 3 Authentication and Data Transmission After the identification is verified and data encryption activated, a secure tunnel is established between the client and the server.
Chapter 44 Service Control The following table describes the labels in this screen. Table 208 System > SSH LABEL DESCRIPTION Enable Select the check box to allow or disallow the computer with the IP address that matches the IP address(es) in the Service Control table to access the ZyWALL CLI using this service. Version 1 Select the check box to have the ZyWALL use both SSH version 1 and version 2 protocols. If you clear the check box, the ZyWALL uses only SSH version 2 protocol.
Chapter 44 Service Control Figure 448 SSH Example 1: Store Host Key Enter the password to log in to the ZyWALL. The CLI screen displays next. 44.7.2 Example 2: Linux This section describes how to access the ZyWALL using the OpenSSH client program that comes with most Linux distributions. 1 Test whether the SSH service is available on the ZyWALL. Enter “telnet 192.168.1.1 22” at a terminal prompt and press [ENTER].
Chapter 44 Service Control 3 The CLI screen displays next. 44.8 Telnet You can use Telnet to access the ZyWALL’s command line interface. Specify which zones allow Telnet access and from which IP address the access can come. 44.8.1 Configuring Telnet Click System > TELNET to configure your ZyWALL for remote Telnet access. Use this screen to specify from which zones Telnet can be used to manage the ZyWALL. You can also specify from which IP addresses the access can come.
Chapter 44 Service Control Table 209 System > Telnet (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 44.9 Configuring FTP You can upload and download the ZyWALL’s firmware and configuration files using FTP. To use this feature, your computer must have an FTP client. Please see Chapter 45 on page 615 for more information about firmware and configuration files.
Chapter 44 Service Control Table 210 System > FTP (continued) LABEL DESCRIPTION Address This is the object name of the IP address(es) with which the computer is allowed or denied to access. Action This displays whether the computer with the IP address specified above can access the ZyWALL zone(s) configured in the Zone field (Accept) or not (Deny). Add icon Click the Add icon in the heading row to open a screen where you can add a new rule.
Chapter 44 Service Control An agent is a management software module that resides in a managed device (the ZyWALL). An agent translates the local management information from the managed device into a form compatible with SNMP. The manager is the console through which network administrators perform network management functions. It executes applications that control and monitor managed devices.
Chapter 44 Service Control 44.10.3 Configuring SNMP To change your ZyWALL’s SNMP settings, click System > SNMP tab. The screen appears as shown. Use this screen to configure your SNMP settings, including from which zones SNMP can be used to access the ZyWALL. You can also specify from which IP addresses the access can come. Figure 454 System > SNMP The following table describes the labels in this screen.
Chapter 44 Service Control Table 212 System > SNMP (continued) LABEL DESCRIPTION Add icon Click the Add icon in the heading row to open a screen where you can add a new rule. Refer to Table 207 on page 592 for information on the fields. Click the Edit icon to go to the screen where you can edit the rule. Click the Add icon in an entry to add a rule below the current entry. Click the Delete icon to remove an existing rule. A window display asking you to confirm that you want to delete the rule.
Chapter 44 Service Control Figure 455 System > Dial-in Mgmt The following table describes the labels in this screen. Table 213 System > Dial-in Mgmt LABEL DESCRIPTION Enable Select this check box to turn on dial-in management. Description Enter some information about this connection. Mute Select this check box to stop the external serial modem from making audible sounds during a dial-in management session.
Chapter 44 Service Control 44.14 Configuring Vantage CNM Vantage CNM is disabled on the device by default. Click System > Vantage CNM to configure your device’s Vantage CNM settings. Figure 456 System > Vantage CNM The following table describes the labels in this screen. Table 214 System > Vantage CNM LABEL DESCRIPTION Enable Select this check box to allow Vantage CNM to manage your ZyWALL. Server IP Address/ FQDN Enter the IP address or fully qualified domain name of the Vantage server.
Chapter 44 Service Control Table 214 System > Vantage CNM (continued) 612 LABEL DESCRIPTION HTTPS Authentication When you are using HTTPs, select this option to have the ZyWALL authenticate the Vantage CNM server’s certificate. In order to do this you need to import the Vantage CNM server’s public key (certificate) into the ZyWALL’s trusted certificates. Vantage Certificate Select the Vantage CNM server’s certificate. This applies when you enable HTTPS authentication.
P ART VII Maintenance & Troubleshooting File Manager (615) Logs (625) Reports (637) Diagnostics (647) Reboot (649) Troubleshooting (651) 613
CHAPTER 45 File Manager This chapter covers how to use the ZyWALL’s File Manager screens to handle the ZyWALL’s configuration, firmware and shell script files. 45.1 Configuration Files and Shell Scripts Overview The File Manager screens allow you to store multiple configuration files and shell script files. When you apply a configuration file, the ZyWALL uses the factory default settings for any features that the configuration file does not include.
Chapter 45 File Manager While configuration files and shell scripts have the same syntax, the ZyWALL applies configuration files differently than it runs shell scripts. This is explained below. Table 215 Configuration Files and Shell Scripts in the ZyWALL Configuration Files (.conf) Shell Scripts (.zysh) • • • • • Resets to default configuration. Goes into CLI Configuration mode. Runs the commands in the configuration file. Goes into CLI Privilege mode. Runs the commands in the shell script.
Chapter 45 File Manager Lines 1 and 2 are comments. Line 5 exits sub command mode. ! this is from Joe # on 2006/06/05 interface ge1 ip address dhcp ! 45.1.2 Errors in Configuration Files or Shell Scripts When you apply a configuration file or run a shell script, the ZyWALL processes the file lineby-line. The ZyWALL checks the first line and applies the line if no errors are detected. Then it continues with the next line.
Chapter 45 File Manager You can change the way the startup-config.conf file is applied. Include the setenvstartup stop-on-error off command. The ZyWALL ignores any errors in the startupconfig.conf file and applies all of the valid commands. The ZyWALL still generates a log for any errors. 45.2 Configuration File Screen Click Maintenance > File Manager > Configuration File to open the Configuration File screen. Use the Configuration File screen to store and name configuration files.
Chapter 45 File Manager The following table describes the labels in this screen. Table 216 Maintenance > File Manager > Configuration File LABEL DESCRIPTION Download Click a configuration file’s row to select it and click Download to save the configuration to your computer. Copy Use this button to save a duplicate of a configuration file on the ZyWALL. Click a configuration file’s row to select it and click Copy to open the Copy File screen.
Chapter 45 File Manager Table 216 Maintenance > File Manager > Configuration File (continued) LABEL DESCRIPTION # This column displays the number for each configuration file entry. The total number of configuration files that you can save depends on the sizes of the configuration files and the available flash storage space. File Name This column displays the label that identifies a configuration file. You cannot delete the following configuration files or change their file names. The system-default.
Chapter 45 File Manager The ZyWALL’s firmware package cannot go through the ZyWALL when you enable the antivirus Destroy compressed files that could not be decompressed option. The ZyWALL classifies the firmware package as not being able to be decompressed and deletes it. You can upload the firmware package to the ZyWALL with the option enabled, so you only need to clear the Destroy compressed files that could not be decompressed option while you download the firmware package. See Section 28.3.
Chapter 45 File Manager Figure 462 Firmware Upload In Process The ZyWALL automatically restarts in this time causing a temporary network disconnect. In some operating systems, you may see the following icon on your desktop. Figure 463 Network Temporarily Disconnected After five minutes, log in again and check your new firmware version in the HOME screen. If the upload was not successful, the following message appears in the status bar at the bottom of the screen. Figure 464 Firmware Upload Error 45.
Chapter 45 File Manager Figure 465 Maintenance > File Manager > Shell Script Each field is described in the following table. Table 218 Maintenance > File Manager > Shell Script LABEL DESCRIPTION Download Click a shell script file’s row to select it and click Download to save the configuration to your computer. Copy Use this button to save a duplicate of a shell script file on the ZyWALL. Click a shell script file’s row to select it and click Copy to open the Copy File screen.
Chapter 45 File Manager Table 218 Maintenance > File Manager > Shell Script (continued) LABEL DESCRIPTION Rename Use this button to change the label of a shell script file on the ZyWALL. You cannot rename a shell script to the name of another shell script in the ZyWALL. Click a shell script’s row to select it and click Rename to open the Rename File screen. Figure 467 Maintenance > File Manager > Shell Script > Rename Specify the new name for the shell script file.
CHAPTER 46 Logs This chapter provides general information about the ZyWALL’s log feature. See Appendix B on page 663 for individual log descriptions. The following table displays the maximum number of system log messages in the ZyWALL.
Chapter 46 Logs Figure 468 Maintenance > Log > View Log If an event generates log messages and alerts, it is displayed in red. Otherwise, it is displayed in black. The following table describes the labels in this screen. Table 220 Maintenance > Log > View Log LABEL DESCRIPTION Show Filter / Hide Filter Click this button to show or hide the filter settings. If the filter settings are hidden, the Display, Email Log Now, Refresh, and Clear Log fields are available.
Chapter 46 Logs Table 220 Maintenance > Log > View Log (continued) LABEL DESCRIPTION Keyword Type a keyword to look for in the Message, Source, Destination and Note fields. If a match is found in any field, the log message is displayed. You can use up to 63 alphanumeric characters and the underscore, as well as punctuation marks ()’ ,:;?! +-*/= #$% @ ; the period, double quotes, and brackets are not allowed. Search Click this button to update the log using the current filter settings.
Chapter 46 Logs For alerts, the Log Settings tab controls which events generate alerts and where alerts are emailed. The Log Settings Summary screen provides a summary of all the settings. You can use the Log Settings Edit screen to maintain the detailed settings (such as log categories, e-mail addresses, server names, etc.) for any log.
Chapter 46 Logs Table 221 Maintenance > Log > Log Setting (continued) LABEL DESCRIPTION Modify This column provides icons to activate or deactivate logs and to modify the settings. To activate or deactivate a log, click the Active icon. Make sure you click Apply to save and apply the change. To edit the settings, click the Edit icon next to the associated log. The Log Settings Edit screen appears. Active Log Summary Click this button to open the Active Log Summary Edit screen.
Chapter 46 Logs Figure 470 Maintenance > Log > Log Setting > E-mail > Edit 630 ZyWALL USG 1000 User’s Guide
Chapter 46 Logs The following table describes the labels in this screen. Table 222 Maintenance > Log > Log Setting > E-mail > Edit LABEL DESCRIPTION E-Mail Server 1/2 Active Select this to send log messages and alerts according to the information in this section. You specify what kinds of log messages are included in log information and what kinds of log messages are included in alerts in the Active Log and Alert section. Mail Server Type the name or IP address of the outgoing SMTP server.
Chapter 46 Logs Table 222 Maintenance > Log > Log Setting > E-mail > Edit (continued) LABEL DESCRIPTION Log Consolidation Active Select this to activate log consolidation. Log consolidation aggregates multiple log messages that arrive within the specified Log Consolidation Interval. In the View Log tab, the text “[count=x]”, where x is the number of original log messages, is appended at the end of the Message field, when multiple log messages were aggregated.
Chapter 46 Logs Figure 471 Maintenance > Log > Log Setting > Remote Server > Edit ZyWALL USG 1000 User’s Guide 633
Chapter 46 Logs The following table describes the labels in this screen. Table 223 Maintenance > Log > Log Setting > Remote Server > Edit LABEL DESCRIPTION Log Settings for Remote Server 1 Active Select this check box to send log information according to the information in this section. You specify what kinds of messages are included in log information in the Active Log section. Log Format This field displays the format of the log information. It is read-only.
Chapter 46 Logs Figure 472 Active Log Summary This screen provides a different view and a different way of indicating which messages are included in each log and each alert. Please see Section 46.3.1 on page 629, where this process is discussed. (The Default category includes debugging messages generated by open source software.) The following table describes the fields in this screen.
Chapter 46 Logs Table 224 Maintenance > Log > Log Setting > Active Log Summary (continued) LABEL Selection 636 DESCRIPTION Select what information you want to log from each Log Category (except All Logs; see below).
CHAPTER 47 Reports This chapter provides information about the report screens. 47.1 Traffic Screen Click Maintenance > Report > Traffic to display the Traffic screen. The Traffic screen provides basic information about the following metrics: • Most-visited Web sites and the number of times each one was visited. This count may not be accurate in some cases because the ZyWALL counts HTTP GET packets. Please see Table 225 on page 638 for more information.
Chapter 47 Reports Figure 473 Maintenance > Report > Traffic There is a limit on the number of records shown in the report. Please see Table 226 on page 640 for more information. The following table describes the labels in this screen. Table 225 Maintenance > Report > Traffic LABEL DESCRIPTION Data Collection Collect Statistics Select this to have the ZyWALL collect data for the report. If the ZyWALL has already been collecting data, the collection period displays to the right.
Chapter 47 Reports Table 225 Maintenance > Report > Traffic (continued) LABEL DESCRIPTION Traffic Type Select the type of report to display. Choices are: Host IP Address/User - displays the IP addresses or users with the most traffic and how much traffic has been sent to and from each one. Service/Port - displays the most-used protocols or service ports and the amount of traffic for each one. Web Site Hits - displays the most-visited Web sites and how many times each one has been visited.
Chapter 47 Reports Table 225 Maintenance > Report > Traffic (continued) LABEL DESCRIPTION Web Site This field displays the domain names most often visited. The ZyWALL counts each page viewed on a Web site as another hit. The maximum number of domain names in this report is indicated in Table 226 on page 640. Hits This field displays how many hits the Web site received. The ZyWALL counts hits by counting HTTP GET packets.
Chapter 47 Reports Figure 474 Maintenance > Report > Session The following table describes the labels in this screen. Table 227 Maintenance > Report > Session LABEL DESCRIPTION View Select how you want the information to be displayed. Choices are: sessions by users - display all active sessions by user sessions by services - display all active sessions by service or protocol all sessions - filter the active sessions by the User, Service, Source Address, and Destination Address, and display them by user.
Chapter 47 Reports Table 227 Maintenance > Report > Session (continued) LABEL DESCRIPTION Protocol Service This field displays the protocol used in each active session. If you are looking at the sessions by services report, click the blue plus sign (+) next to each protocol to look at detailed session information by user. Source This field displays the source IP address and port in each active session. Destination This field displays the destination IP address and port in each active session.
Chapter 47 Reports Table 228 Maintenance > Report > Anti-Virus (continued) LABEL DESCRIPTION Infected Files Detected This field displays the number of files in which the ZyWALL has detected a virus. Top Entry By Use this field to have the following (read-only) table display the top anti-virus entries by Virus Name, Source or Destination. Select Virus Name to list the most common viruses that the ZyWALL has detected.
Chapter 47 Reports Figure 478 Maintenance > Report > IDP: Signature Name The following table describes the labels in this screen. Table 229 Maintenance > Report > IDP LABEL DESCRIPTION Collect Statistics Select this check box to have the ZyWALL collect IDP statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second.
Chapter 47 Reports Table 229 Maintenance > Report > IDP (continued) LABEL DESCRIPTION Type This column displays when you display the entries by Signature Name. It shows the categories of intrusions. See Table 132 on page 427 for more information. Severity This column displays when you display the entries by Signature Name. It shows the level of threat that the intrusions may pose. See Table 131 on page 426 for more information. Source IP This column displays when you display the entries by Source.
Chapter 47 Reports 646 ZyWALL USG 1000 User’s Guide
CHAPTER 48 Diagnostics This chapter covers how to use the Diagnostics screen. 48.1 Diagnostics The Diagnostics screen provides an easy way for you to generate a file containing the ZyWALL’s configuration and diagnostic information. You may need to generate this file and send it to customer support during troubleshooting. Click Maintenance > Diagnostics to open the Diagnostics screen. Figure 481 Maintenance > Diagnostics The following table describes the labels in this screen.
Chapter 48 Diagnostics 648 ZyWALL USG 1000 User’s Guide
CHAPTER 49 Reboot Use this to restart the device (for example, if the device begins behaving erratically). See also Section 1.4 on page 55 for information on different ways to start and stop the ZyWALL. If you applied changes in the Web configurator, these were saved automatically and do not change when you reboot. If you made changes in the CLI, however, you have to use the write command to save the configuration before you reboot. Otherwise, the changes are lost when you reboot.
Chapter 49 Reboot 650 ZyWALL USG 1000 User’s Guide
CHAPTER 50 Troubleshooting This chapter offers some suggestions to solve problems you might encounter. V I cannot set up an IPSec VPN tunnel to another device. If the IPSec tunnel does not build properly, the problem is likely a configuration error at one of the IPSec routers. Log into both ZyXEL IPSec routers and check the settings in each field methodically and slowly. It may help to display the settings for both routers side-by-side. Here are some general suggestions. See also Section 20.
Chapter 50 Troubleshooting Routing policies define how the ZyWALL forwards packets to their destinations. You must create a policy route for the ZyWALL to route VPN traffic through a VPN tunnel to the remote network. The VPN wizard automatically creates a corresponding policy route. If you use the VPN > IPSec VPN or VPN > L2TP VPN screens to set up a VPN tunnel, you need to manually configure a policy route for the VPN tunnel. V I cannot download the ZyWALL’s firmware package.
Chapter 50 Troubleshooting If you want to reboot the device without changing the current configuration, see Chapter 49 on page 649. 1 Make sure the SYS LED is on and not blinking. 2 Press the RESET button and hold it until the SYS LED begins to blink. (This usually takes about five seconds.) 3 Release the RESET button, and wait for the ZyWALL to restart. You should be able to access the ZyWALL using the default settings.
Chapter 50 Troubleshooting 654 ZyWALL USG 1000 User’s Guide
P ART VIII Appendices and Index Product Specifications (657) Common Services (703) Displaying Anti-Virus Alert Messages in Windows (707) Open Software Announcements (719) Legal Information (755) Customer Support (759) Index (765) 655
APPENDIX A Product Specifications The following specifications are subject to change without notice. See Chapter 2 on page 57 for a general overview of key features. This table provides basic device specifications. Table 231 Default Login Information ATTRIBUTE SPECIFICATION Default IP Address (ge1) 192.168.1.1 Default Subnet Mask (ge1) 255.255.255.0 (24 bits) Default Password 1234 This table provides hardware specifications.
Appendix A Product Specifications Table 233 Feature Specifications FEATURE VERSION # V2.
Appendix A Product Specifications Table 233 Feature Specifications (continued) FEATURE VERSION # V2.
Appendix A Product Specifications Table 233 Feature Specifications (continued) FEATURE VERSION # V2.
Appendix A Product Specifications Table 234 Standards Referenced by Features (continued) FEATURE STANDARDS REFERENCED Built-in service, SNMP agent RFCs 1067, 1213, 2576, 2578, 2579, 2580, 2741, 2667, 2981, 3371 Login, LDAP support. RFCs 2251, 2252, 2253, 2254, 2255, 2256, 2589, 2829, 2830 Used by Apache RFCs 2437, 2246, 2560, 2712, 3268, 3280, 3820, 4132 Built-in service, FTP server RFCs 959, 2228, 2389, 2865, 2138, 2640 Used by Centralized log RFC 3164 Login, new PAM module OSF-RFC 86.
Appendix A Product Specifications 662 ZyWALL USG 1000 User’s Guide
APPENDIX B Log Descriptions This appendix provides descriptions of example log messages. Table 235 Content Filter Logs LOG MESSAGE DESCRIPTION Content filter has been enabled An administrator turned the content filter on. Content filter has been disabled An administrator turned the content filter off. Table 236 Forward Web Site Logs LOG MESSAGE DESCRIPTION %s: Trusted Web site The device allowed access to a web site in a trusted domain.
Appendix B Log Descriptions Table 237 Blocked Web Site Logs (continued) LOG MESSAGE DESCRIPTION %s: Service is unavailable Content filter rating service is temporarily unavailable and access to the web site was blocked due to: 1. Can't resolve rating server IP (No DNS) 2. Invalid service license 4. Rating service is restarting 5. Can’t connect to rating server 6. Query failed 7. Query timeout 8. Too many queries 9.
Appendix B Log Descriptions Table 238 User Logs LOG MESSAGE DESCRIPTION %s %s has logged in from %s The specified user signed in. 1st %s: Administrator|Limited-Admin|User|Ext-User|Guest 2nd %s: username 3rd %s: service name (HTTP/HTTPS, FTP, telnet, SSH, console) NOTE field: %s means username. %s %s has logged out from %s The specified user signed out.
Appendix B Log Descriptions Table 239 myZyXEL.com Logs LOG MESSAGE DESCRIPTION Send registration message to MyZyXEL.com server has failed. The device was not able to send a registration message to MyZyXEL.com. Get server response has failed. The device sent packets to the MyZyXEL.com server, but did not receive a response. The root cause may be that the connection is abnormal. Timeout for get server response. zysh need to catch MyZyXEL.com agent's return code, this log will be shown when timeout.
Appendix B Log Descriptions Table 239 myZyXEL.com Logs (continued) LOG MESSAGE DESCRIPTION Service expiration check has succeeded. The service expiration day check was successful. Service expiration check has failed. Because of lack must fields. The device received an incomplete response from the myZyXEL.com server and it caused a parsing error for the device. Server setting error. The device could not retrieve the myZyXEL.com server's IP address or FQDN from local. Resolve server IP has failed.
Appendix B Log Descriptions Table 239 myZyXEL.com Logs (continued) 668 LOG MESSAGE DESCRIPTION Update server is busy now. File download after %d seconds. The update server was busy so the device will wait for the specified number of seconds and send the download request to the update server again. Device has latest file. No need to update. The device already has the latest version of the file so no update is needed.
Appendix B Log Descriptions Table 239 myZyXEL.com Logs (continued) LOG MESSAGE DESCRIPTION Do expiration dailycheck has failed. Because of lack must fields. The device received an incomplete response to the daily service expiration check and the packets caused a parsing error for the device. Server setting error. The device could not retrieve the server's IP address or FQDN from local. Do expiration dailycheck has failed. The daily check for service expiration failed.
Appendix B Log Descriptions Table 239 myZyXEL.com Logs (continued) LOG MESSAGE DESCRIPTION Certification verification failed: Depth: %d, Error Number(%d):%s. Verification of a server’s certificate failed while processing an HTTPS connection. This log identifies the reason for the failure. 1st %d: certificate chain level 2nd %d: error number %s: error message Certificate issuer name:%s. Verification of the specified certificate failed because the device could not get the certificate’s issuer name.
Appendix B Log Descriptions Table 240 IDP Logs (continued) LOG MESSAGE DESCRIPTION IDP service standard license is expired. Update signature failed. IDP service standard license is expired. IDP signature cannot update. IDP service standard license is not registered. Update signature failed. IDP service standard license is not registered. IDP signature cannot update. IDP service trial license is expired. Update signature failed. IDP service trial license is expired. IDP signature cannot update.
Appendix B Log Descriptions Table 240 IDP Logs (continued) 672 LOG MESSAGE DESCRIPTION IDP off-line update failed. File damaged. IDP signature off-line update failed. Signature file maybe corrupt. IDP signature update failed. File crashed. IDP signature update failed. Decrypt signature file failed. IDP signature update failed. File damaged. IDP signature update failed. Decompress signature file failed. IDP signature update failed. File update failed. IDP signature update failed.
Appendix B Log Descriptions Table 240 IDP Logs (continued) LOG MESSAGE DESCRIPTION IDP signature update failed. Invalid signature content. IDP signature update failed. Sigquery check signature content failed. System internal error. Create IDP traffic anomaly entry failed. System internal error. Create IDP traffic anomaly entry failed. Query signature version failed. Unable to get signature version from new signature package download from update server Can not get signature version.
Appendix B Log Descriptions Table 241 Application Patrol Logs (continued) 674 LOG MESSAGE DESCRIPTION System fatal error: 60018009. Error when do ioctl L7_ACTION_IOCTL_ADDR_USAGE. System fatal error: 60018010. Error when do ioctl L7_ACTION_IOCTL_PROTO_ADDR_NUMS. System fatal error: 60018011. Fail to user lib user_profile to retrieve current login user. System fatal error: 60018012. Fail to user lib user_profile to retrieve current login user. System fatal error: 60018013.
Appendix B Log Descriptions Table 241 Application Patrol Logs (continued) LOG MESSAGE DESCRIPTION App Patrol Name=%s Type=%s %s=%d Protocol=%s Action=%s Packets logging. 1st %s: Protocol Name, 2nd %s: Category Name, 3rd %s: Default Rule or Exception Rule, 1st %d: Rule Index, 4th %s: TCP or UDP, 5th %s: Action. App Patrol resources ran out. User %s is unrestricted by rule [ %s:%d ].
Appendix B Log Descriptions Table 242 IKE Logs (continued) LOG MESSAGE DESCRIPTION [SA] : Tunnel [%s] Phase 1 authentication algorithm mismatch %s is the tunnel name. When negotiating Phase-1, the authentication algorithm did not match. [SA] : Tunnel [%s] Phase 1 authentication method mismatch %s is the tunnel name. When negotiating Phase-1, the authentication method did not match. [SA] : Tunnel [%s] Phase 1 encryption algorithm mismatch %s is the tunnel name.
Appendix B Log Descriptions Table 242 IKE Logs (continued) LOG MESSAGE DESCRIPTION Cannot resolve My IP Addr %s for Tunnel [%s] 1st %s is my ip address. 2nd %s is the tunnel name. When selecting a matched proposal in phase-1, the engine could not get My-IP address. Cannot resolve Secure Gateway Addr %s for Tunnel [%s] 1st %s is my ip address. 2nd %s is the tunnel name; When selecting a matched proposal in phase-1, the engine could not get the correct secure gateway address.
Appendix B Log Descriptions Table 242 IKE Logs (continued) LOG MESSAGE DESCRIPTION The cookie pair is : 0x%08x%08x / 0x%08x%08x Indicates the initiator/responder cookie pair. The IPSec tunnel "%s" %s is the tunnel name. When dialing a tunnel, the tunnel is already is already established dialed. 678 Tunnel [%s] built successfully %s is the tunnel name. The phase-2 tunnel negotiation is complete. Tunnel [%s] Phase 1 pre-shared key mismatch %s is the tunnel name.
Appendix B Log Descriptions Table 242 IKE Logs (continued) LOG MESSAGE DESCRIPTION Tunnel [%s:%s] Sending IKE request The variables represent the phase 1 name and tunnel name. The device sent an IKE request. Tunnel [%s:0x%x] is disconnected The variables represent the tunnel name and the SPI of a tunnel that was disconnected. Tunnel [%s] rekeyed successfully %s is the tunnel name. The tunnel was rekeyed successfully.
Appendix B Log Descriptions Table 244 Firewall Logs LOG MESSAGE DESCRIPTION priority:%lu, from %s to %s, service %s, %s 1st variable is the global index of rule, 2nd is the from zone, 3rd is the to zone, 4th is the service name, 5th is ACCEPT/DROP/ REJECT. %s:%d: in %s(): Firewall is dead, trace to %s is which file, %d is which line, %s is which function Firewall has been %s. %s is enabled/disabled Firewall rule %d has been moved to %d.
Appendix B Log Descriptions Table 246 Policy Route Logs (continued) LOG MESSAGE DESCRIPTION Cannot get handle from UAM, user-aware PR is disabled User-aware policy routing is disabled due to some reason. mblock: allocate memory failed! Allocating policy routing rule fails: insufficient memory. pt: allocate memory failed! Allocating policy routing rule fails: insufficient memory. To send message to policy route daemon failed! Failed to send control message to policy routing manager.
Appendix B Log Descriptions Table 247 Built-in Services Logs LOG MESSAGE DESCRIPTION User on %u.%u.%u.%u has been denied access from %s HTTP/HTTPS/TELNET/SSH/FTP/SNMP access to the device was denied. %u.%u.%u.%u is IP address %s is HTTP/HTTPS/SSH/SNMP/FTP/TELNET HTTPS certificate:%s An administrator assigned a nonexistent certificate to HTTPS. does not exist. HTTPS %s is certificate name assigned by user service will not work. HTTPS port has been changed to port %s.
Appendix B Log Descriptions Table 247 Built-in Services Logs (continued) LOG MESSAGE DESCRIPTION Console baud has been changed to %s. An administrator changed the console port baud rate. %s is baud rate assigned by user Console baud has been reset to %d. An administrator changed the console port baud rate back to the default (115200).
Appendix B Log Descriptions Table 247 Built-in Services Logs (continued) 684 LOG MESSAGE DESCRIPTION The default record of Zone Forwarder have reached the maximum number of 128 DNS servers. The default record DNS servers is more than 128. Interface %s ping check is successful. Zone Forwarder adds DNS servers in records. Ping check ok, add DNS servers in bind. %s is interface name Interface %s ping check is failed. Zone Forwarder removes DNS servers in records.
Appendix B Log Descriptions Table 247 Built-in Services Logs (continued) LOG MESSAGE DESCRIPTION Access control rule %d An access control rule was moved successfully. of %s was moved to %d. 1st %d is the previous index . %s is HTTP/HTTPS/SSH/SNMP/FTP/TELNET. 2nd %d is current previous index. SNMP trap can not be sent successfully Cannot send a SNMP trap to a remote host due to network error Table 248 System Logs LOG MESSAGE DESCRIPTION Port %d is up!! When LINK is up, %d is the port number.
Appendix B Log Descriptions Table 248 System Logs (continued) LOG MESSAGE DESCRIPTION Receive an ARP response from an unknown client The device received an ARP response from an unknown client. In total, received %d arp response packets for the requested IP address The device received the specified total number of ARP response packets for the requested IP address. Clear arp cache successfully. The ARP cache was cleared successfully.
Appendix B Log Descriptions Table 248 System Logs (continued) LOG MESSAGE DESCRIPTION Update the profile %s has failed because the FQDN %s is not under your control. The owner of this FQDN is not the user, 1st %s is the profile name, 2nd %s is the FQDN of the profile. Update the profile %s has failed because the FQDN %s was blocked for abuse. The FQDN is blocked by DynDNS, 1st %s is the profile name, 2nd %s is the FQDN of the profile. Update the profile %s has failed because of authentication fail.
Appendix B Log Descriptions Table 248 System Logs (continued) LOG MESSAGE DESCRIPTION Update the profile %s has failed because Custom IP was empty. The DDNS profile's IP select type is custom, and a custom IP was not defined, %s is the profile name. Update the profile %s has failed because WAN interface was empty. If the DDNS profile's IP select type is iface, it needs a WAN iface, %s is the profile name.
Appendix B Log Descriptions Table 248 System Logs (continued) LOG MESSAGE DESCRIPTION DDNS has been enabled by Device-HA. DDNS is enabled by Device-HA, because one of VRRP groups is active. Disable DDNS has succeeded. Disable DDNS. Enable DDNS has succeeded. Enable DDNS. DDNS profile %s has been renamed as %s. Rename DDNS profile, 1st %s is the original profile name, 2nd %s is the new profile name. DDNS profile %s has been deleted.
Appendix B Log Descriptions Table 249 Connectivity Check Logs (continued) LOG MESSAGE DESCRIPTION Can't get remote address of %s interface The connectivity check process can't get remote address of PPP interface %s: interface name Can't get NETMASK address of %s interface The connectivity check process can't get netmask address of interface.
Appendix B Log Descriptions Table 250 Device HA Logs (continued) LOG MESSAGE DESCRIPTION Master configuration is the same with Backup. Skip updating it. The System Startup configuration file synchronized from the Master is the same with the one in the Backup, so the configuration does not have to be updated.
Appendix B Log Descriptions Table 250 Device HA Logs (continued) LOG MESSAGE DESCRIPTION Device HA authentication type for VRRP group %s maybe wrong. A VRRP group’s Authentication Type (Md5 or IPSec AH) configuration may not match between the Backup and the Master. %s: The name of the VRRP group. Device HA authenticaton string of text for VRRP group %s maybe wrong. A VRRP group’s Simple String (Md5) configuration may not match between the Backup and the Master. %s: The name of the VRRP group.
Appendix B Log Descriptions Table 251 Routing Protocol Logs LOG MESSAGE DESCRIPTION RIP on interface %s has been stopped because Device-HA binds this interface. Device-HA is currently running on the interface %s, so all the local service have to be stopped including RIP.
Appendix B Log Descriptions Table 251 Routing Protocol Logs (continued) 694 LOG MESSAGE DESCRIPTION RIP md5 authentication id and key have been deleted. RIP md5 authentication id and key have been deleted. RIP global version has been deleted. RIP global version has been deleted. RIP redistribute OSPF routes has been disabled. RIP redistribute OSPF routes has been disabled. RIP redistribute static routes has been disabled. RIP redistribute static routes has been disabled.
Appendix B Log Descriptions Table 251 Routing Protocol Logs (continued) LOG MESSAGE DESCRIPTION Invalid OSPF virtuallink %s authentication of area %s. Virtual-link %s authentication has been set to same-as-area but the area has invalid authentication configuration. %s: Virtual-Link ID Invalid OSPF md5 authentication on interface %s. Invalid OSPF md5 authentication is set on interface %s. %s: Interface Name Invalid OSPF text authentication on interface %s.
Appendix B Log Descriptions Table 252 NAT Logs (continued) LOG MESSAGE DESCRIPTION Register H.323 ALG extra port=%d failed. H323 ALG apply additional signal port failed. %d: Port number Register H.323 ALG H323 ALG apply signal port failed. signal port=%d failed. %d: Port number Register FTP ALG extra port=%d failed. FTP ALG apply additional signal port failed. %d: Port number Register FTP ALG FTP ALG apply signal port failed. signal port=%d failed.
Appendix B Log Descriptions Table 253 PKI Logs (continued) LOG MESSAGE DESCRIPTION Import X509 certificate "%s" into My Certificate successfully The device imported a x509 format certificate into My Certificates. %s is the certificate request name. Import X509 certificate "%s" into Trusted Certificate successfully The device imported a x509 format certificate into Trusted Certificates. %s is the certificate request name.
Appendix B Log Descriptions Table 253 PKI Logs (continued) 698 LOG MESSAGE DESCRIPTION Export X509 certificate "%s" from "My Certificate" failed The device was not able to export a x509 format certificate from My Certificates. %s is the certificate request name. Import PKCS#12 certificate "%s" with incorrect password An administrator used the wrong password when trying to import a PKCS#12 format certificate. %s is the certificate name. Cert trusted: %s %s is the subject.
Appendix B Log Descriptions CODE DESCRIPTION 27 Path was not verified. 28 Maximum path length reached. Table 254 Interface Logs LOG MESSAGE DESCRIPTION Interface %s has been deleted. An administrator deleted an interface. %s is the interface name. AUX Interface dialing failed. This AUX interface is not enabled. A user tried to dial the AUX interface, but the AUX interface is not enabled. AUX Interface disconnecting failed. This AUX interface is not enabled.
Appendix B Log Descriptions Table 254 Interface Logs (continued) 700 LOG MESSAGE DESCRIPTION %s MTU > (%s MTU - 8), %s may not work correctly. An administrator configured a PPP interface, PPP interface MTU > (base interface MTU - 8), PPP interface may not run correctly because PPP packets will be fragmented by base interface ans peer will not receive correct PPP packets. 1st %s: PPP interface name, 2nd %s: ethernet interface name. (%s MTU - 8) < %s MTU, %s may not work correctly.
Appendix B Log Descriptions Table 254 Interface Logs (continued) LOG MESSAGE DESCRIPTION Interface %s is disconnected. A PPP or AUX interface disconnected successfully. %s: interface name. Interface %s connect failed: Peer not responding. The interface’s connection will be terminated because the server did not send any LCP packets. %s: interface name. Interface %s connect failed: PAP authentication failed.
Appendix B Log Descriptions Table 257 Force Authentication Logs LOG MESSAGE DESCRIPTION Force User Authentication will be enabled due to http server is enabled. Force user authentication will be turned on because HTTP server was turned on. Force User Authentication will be disabled due to http server is disabled. Force user authentication will be turned off because HTTP server was turned off.
APPENDIX C Common Services The following table lists some commonly-used services and their associated protocols and port numbers. For a comprehensive list of port numbers, ICMP type/code numbers and services, visit the IANA (Internet Assigned Number Authority) web site. • Name: This is a short, descriptive name for the service. You can use this one or create a different one, if you like. • Protocol: This is the type of IP protocol used by the service.
Appendix C Common Services Table 259 Commonly Used Services (continued) 704 NAME PROTOCOL PORT(S) DESCRIPTION FTP TCP TCP 20 21 File Transfer Program, a program to enable fast transfer of files, including large files that may not be possible by e-mail. H.323 TCP 1720 NetMeeting uses this protocol. HTTP TCP 80 Hyper Text Transfer Protocol - a client/ server protocol for the world wide web. HTTPS TCP 443 HTTPS is a secured http session often used in e-commerce.
Appendix C Common Services Table 259 Commonly Used Services (continued) NAME PROTOCOL PORT(S) DESCRIPTION RTSP TCP/UDP 554 The Real Time Streaming (media control) Protocol (RTSP) is a remote control for multimedia on the Internet. SFTP TCP 115 Simple File Transfer Protocol. SMTP TCP 25 Simple Mail Transfer Protocol is the message-exchange standard for the Internet. SMTP enables you to move messages from one e-mail server to another. SNMP TCP/UDP 161 Simple Network Management Program.
Appendix C Common Services 706 ZyWALL USG 1000 User’s Guide
APPENDIX D Displaying Anti-Virus Alert Messages in Windows With the anti-virus packet scan, when a virus is detected, you can have the ZyWALL display an alert message on Miscrosoft Windows-based computers. If the log shows that virus files are being detected but your Miscrosoft Windows-based computer is not displaying an alert message, use one of the following procedures to make sure your computer is set to display the messages. Windows XP 1 Click Start > Control Panel > Administrative Tools > Services.
Appendix D Displaying Anti-Virus Alert Messages in Windows Figure 484 Windows XP: Starting the Messenger Service 3 Close the window when you are done. Windows 2000 1 Click Start > Settings > Control Panel > Administrative Tools > Services. Figure 485 Windows 2000: Opening the Services Window 2 Select the Messenger service and click Start Service.
Appendix D Displaying Anti-Virus Alert Messages in Windows Figure 486 Windows 2000: Starting the Messenger Service 3 Close the window when you are done. Windows 98 SE/Me For Windows 98 SE/Me, you must open the WinPopup window in order to view real-time alert messages. Click Start > Run and enter “winpopup” in the field provided and click OK. The WinPopup window displays as shown.
Appendix D Displaying Anti-Virus Alert Messages in Windows Figure 489 Windows 98 SE: Task Bar Properties 3 Double-click Programs and click StartUp. 4 Right-click in the StartUp pane and click New, Shortcut. Figure 490 Windows 98 SE: StartUp 5 A Create Shortcut window displays. Enter “winpopup” in the Command line field and click Next.
Appendix D Displaying Anti-Virus Alert Messages in Windows Figure 491 Windows 98 SE: Startup: Create Shortcut 6 Specify a name for the shortcut or accept the default and click Finish. Figure 492 Windows 98 SE: Startup: Select a Title for the Program 7 A shortcut is created in the StartUp pane. Restart the computer when prompted.
Appendix D Displaying Anti-Virus Alert Messages in Windows Figure 493 Windows 98 SE: Startup: Shortcut " 712 The WinPopup window displays after the computer finishes the startup process (see Figure 487 on page 709).
APPENDIX E Importing Certificates This appendix shows importing certificates examples using Netscape Navigator and Internet Explorer 5. This appendix uses the ZyWALL 70 as an example. Other models should be similiar. Import ZyWALL Certificates into Netscape Navigator In Netscape Navigator, you can permanently trust the ZyWALL’s server certificate by importing it into your operating system as a trusted certification authority. Select Accept This Certificate Permanently in the following screen to do this.
Appendix E Importing Certificates Figure 495 Login Screen 2 Click Install Certificate to open the Install Certificate wizard. Figure 496 Certificate General Information before Import 3 Click Next to begin the Install Certificate wizard.
Appendix E Importing Certificates Figure 497 Certificate Import Wizard 1 4 Select where you would like to store the certificate and then click Next. Figure 498 Certificate Import Wizard 2 5 Click Finish to complete the Import Certificate wizard.
Appendix E Importing Certificates Figure 499 Certificate Import Wizard 3 6 Click Yes to add the ZyWALL certificate to the root store.
Appendix E Importing Certificates Figure 501 Certificate General Information after Import ZyWALL USG 1000 User’s Guide 717
Appendix E Importing Certificates 718 ZyWALL USG 1000 User’s Guide
APPENDIX F Open Software Announcements Notice Information herein is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, except the express written permission of ZyXEL Communications Corporation. " This Product includes ppp-2.4.
Appendix F Open Software Announcements " This Product includes Netkit Telnet -0.17 software under the Netkit Telnet License Netkit Telnet License Copyright (c) 1989 Regents of the University of California. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1.Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2.
Appendix F Open Software Announcements " This Product includes expat-1.95.
Appendix F Open Software Announcements " This Product includes openssl-0.9.8d-ocf software under the OpenSSL License OpenSSL The OpenSSL toolkit stays under a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. Actually both licenses are BSD-style Open Source licenses. In case of any license issues related to OpenSSL please contact openssl-core@openssl.org.
Appendix F Open Software Announcements OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes software written by Tim Hudson (tjh@cryptsoft.com). Original SSLeay License Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) All rights reserved. This package is an SSL implementation written by Eric Young (eay@cryptsoft.com).
Appendix F Open Software Announcements " This Product includes libevent-1.1a and xinetd-2.3.14 software under the a 3clause BSD License a 3-clause BSD-style license This is a Free Software License • This license is compatible with The GNU General Public License, Version 1 • This license is compatible with The GNU General Public License, Version 2 This is the BSD license without the obnoxious advertising clause. It's also known as the "modified BSD license.
Appendix F Open Software Announcements The ISC license for bind is: Copyright (c) 1993-1999 by Internet Software Consortium. Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
Appendix F Open Software Announcements Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
Appendix F Open Software Announcements 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royaltyfree, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License.
Appendix F Open Software Announcements 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty.
Appendix F Open Software Announcements Products derived from this software may not be called "Apache", nor may "Apache" appear in their name, without prior written permission of the Apache Software Foundation. THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
Appendix F Open Software Announcements This license, the Lesser General Public License, applies to some specially designated software packages--typically libraries--of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.
Appendix F Open Software Announcements For example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.
Appendix F Open Software Announcements 2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) The modified work must itself be a software library. b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.
Appendix F Open Software Announcements However, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.
Appendix F Open Software Announcements It may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute. 7.
Appendix F Open Software Announcements 12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 13.
Appendix F Open Software Announcements " This Product includes bridge-utils, dhcpcd-1.3.22-pl4, rp-pppoe-3.5, vlan-1.8, keepalived-1.1.11-p1, quagga-0.99.2, ez-ipupdate-3.0.11b7, proftpd-1.2.10, libol-0.3.14, syslog-ng-1.6.5, pam-0.76, bison, tzcode2006c, iproute2, iptables-1.2.11/netfilter(kernel), dhcp-helper, busybox, Linux kernel, and pptplinux-1.4.0 software under GPL license. GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc.
Appendix F Open Software Announcements TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License.
Appendix F Open Software Announcements right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3.
Appendix F Open Software Announcements 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License.
Appendix F Open Software Announcements FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12.
Appendix F Open Software Announcements AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. " This Product includes libxml2-2.6.
Appendix F Open Software Announcements THIS SOFTWARE IS PROVIDED BY THE OPENLDAP FOUNDATION AND ITS CONTRIBUTORS ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
Appendix F Open Software Announcements 2.1 GUBUSOFT hereby grants Customer the following non-exclusive, non-transferable right to use the SOFTWARE. 2.1.3 LIMITATIONS Customer may not rent, lease, or transfer the rights to the SOFTWARE to someone else.
Appendix F Open Software Announcements Defensive Suspension. If Customer commences or participates in any legal proceeding against GUBUSOFT, then GUBUSOFT may, in its sole discretion, suspend or terminate all license grants and any other rights provided under this LICENSE during the pendency of such legal proceedings. 4.
Appendix F Open Software Announcements " This Product includes overLIB software under the overLIB License (Artistic) License (Artistic) Preamble The intent of this document is to state the conditions under which a Package may be copied, such that the Copyright Holder maintains some semblance of artistic control over the development of the package, while giving the users of the package the right to use and distribute the Package in a more-or-less customary fashion, plus the right to make reasonable modifi
Appendix F Open Software Announcements make other distribution arrangements with the Copyright Holder. You may distribute the programs of this Package in object code or executable form, provided that you do at least ONE of the following: distribute a Standard Version of the executables and library files, together with instructions (in the manual page or equivalent) on where to get the Standard Version. accompany the distribution with the machine-readable source of the Package with your modifications.
Appendix F Open Software Announcements BY EXERCISING ANY RIGHTS TO THE WORK PROVIDED HERE, YOU ACCEPT AND AGREE TO BE BOUND BY THE TERMS OF THIS LICENSE. THE LICENSOR GRANTS YOU THE RIGHTS CONTAINED HERE IN CONSIDERATION OF YOUR ACCEPTANCE OF SUCH TERMS AND CONDITIONS. 1. Definitions a.
Appendix F Open Software Announcements ii.Mechanical Rights and Statutory Royalties. Licensor waives the exclusive right to collect, whether individually or via a music rights agency or designated agent (e.g. Harry Fox Agency), royalties for any phonorecord You create from the Work ("cover version") and distribute, subject to the compulsory license created by 17 USC Section 115 of the US Copyright Act (or the equivalent in other jurisdictions). f.Webcasting Rights and Statutory Royalties.
Appendix F Open Software Announcements 5.
Appendix F Open Software Announcements e.This License constitutes the entire agreement between the parties with respect to the Work licensed here. There are no understandings, agreements or representations with respect to the Work not specified here. Licensor shall not be bound by any additional provisions that may appear in any communication from You. This License may not be modified without the mutual written agreement of the Licensor and You.
Appendix F Open Software Announcements You have no ownership rights in the Software. Rather, you have a license to use the Software as long as this License Agreement remains in full force and effect. Ownership of the Software, Documentation and all intellectual property rights therein shall remain at all times with ZyXEL. Any other use of the Software by any other entity is strictly forbidden and is a violation of this License Agreement. 3.
Appendix F Open Software Announcements THE WAIVER OR EXCLUSION OF IMPLIED WARRANTIES SO THEY MAY NOT APPLY TO YOU. IF THIS EXCLUSION IS HELD TO BE UNENFORCEABLE BY A COURT OF COMPETENT JURISDICTION, THEN ALL EXPRESS AND IMPLIED WARRANTIES SHALL BE LIMITED IN DURATION TO A PERIOD OF THIRTY (30) DAYS FROM THE DATE OF PURCHASE OF THE SOFTWARE, AND NO WARRANTIES SHALL APPLY AFTER THAT PERIOD. 7.
Appendix F Open Software Announcements This License Agreement is effective until it is terminated. You may terminate this License Agreement at any time by destroying or returning to ZyXEL all copies of the Software and Documentation in your possession or under your control. ZyXEL may terminate this License Agreement for any reason, including, but not limited to, if ZyXEL finds that you have violated any of the terms of this License Agreement.
Appendix F Open Software Announcements 754 ZyWALL USG 1000 User’s Guide
APPENDIX G Legal Information Copyright Copyright © 2007 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation.
Appendix G Legal Information FCC Warning This device has been tested and found to comply with the limits for a Class A digital switch, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a commercial environment. This device generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications.
Appendix G Legal Information Note Repair or replacement, as provided under this warranty, is the exclusive remedy of the purchaser. This warranty is in lieu of all other warranties, express or implied, including any implied warranty of merchantability or fitness for a particular use or purpose. ZyXEL shall in no event be held liable for indirect or consequential damages of any kind to the purchaser.
Appendix G Legal Information 758 ZyWALL USG 1000 User’s Guide
APPENDIX H Customer Support Please have the following information ready when you contact customer support. Required Information • • • • Product model and serial number. Warranty Information. Date that you received your device. Brief description of the problem and the steps you took to solve it. “+” is the (prefix) number you dial to make an international telephone call. Corporate Headquarters (Worldwide) • • • • • • • Support E-mail: support@zyxel.com.tw Sales E-mail: sales@zyxel.com.
Appendix H Customer Support • Regular Mail: ZyXEL Communications, Czech s.r.o., Modranská 621, 143 01 Praha 4 Modrany, Ceská Republika Denmark • • • • • • Support E-mail: support@zyxel.dk Sales E-mail: sales@zyxel.dk Telephone: +45-39-55-07-00 Fax: +45-39-55-07-07 Web: www.zyxel.dk Regular Mail: ZyXEL Communications A/S, Columbusvej, 2860 Soeborg, Denmark Finland • • • • • • Support E-mail: support@zyxel.fi Sales E-mail: sales@zyxel.fi Telephone: +358-9-4780-8411 Fax: +358-9-4780-8448 Web: www.zyxel.
Appendix H Customer Support India • • • • • • Support E-mail: support@zyxel.in Sales E-mail: sales@zyxel.in Telephone: +91-11-30888144 to +91-11-30888153 Fax: +91-11-30888149, +91-11-26810715 Web: http://www.zyxel.in Regular Mail: India - ZyXEL Technology India Pvt Ltd., II-Floor, F2/9 Okhla Phase -1, New Delhi 110020, India Japan • • • • • • Support E-mail: support@zyxel.co.jp Sales E-mail: zyp@zyxel.co.jp Telephone: +81-3-6847-3700 Fax: +81-3-6847-3705 Web: www.zyxel.co.
Appendix H Customer Support • Regular Mail: ZyXEL Communications Inc., 1130 N. Miller St., Anaheim, CA 928062001, U.S.A. Norway • • • • • • Support E-mail: support@zyxel.no Sales E-mail: sales@zyxel.no Telephone: +47-22-80-61-80 Fax: +47-22-80-61-81 Web: www.zyxel.no Regular Mail: ZyXEL Communications A/S, Nils Hansens vei 13, 0667 Oslo, Norway Poland • • • • • E-mail: info@pl.zyxel.com Telephone: +48-22-333 8250 Fax: +48-22-333 8251 Web: www.pl.zyxel.com Regular Mail: ZyXEL Communications, ul.
Appendix H Customer Support Sweden • • • • • • Support E-mail: support@zyxel.se Sales E-mail: sales@zyxel.se Telephone: +46-31-744-7700 Fax: +46-31-744-7701 Web: www.zyxel.se Regular Mail: ZyXEL Communications A/S, Sjöporten 4, 41764 Göteborg, Sweden Thailand • • • • • • Support E-mail: support@zyxel.co.th Sales E-mail: sales@zyxel.co.th Telephone: +662-831-5315 Fax: +662-831-5395 Web: http://www.zyxel.co.th Regular Mail: ZyXEL Thailand Co., Ltd.
Appendix H Customer Support 764 ZyWALL USG 1000 User’s Guide
Index Index Numerics 3DES 308 A AAA servers 531 and authentication methods 541 and users 504 LDAP Default 533 LDAP Group 534 LDAP group members 536 RADIUS default 537 RADIUS group 538 RADIUS group members 539 RADIUS. See also RADIUS. where used 122 access control 428 access users 503, 505 forcing login 505 forcing login. See also force user authentication policies. idle timeout 511 in user-aware policies 505 logging in 505 multiple logins 511 see also users 503 web configurator 513 account myZyXEL.
Index and virtual servers 268 FTP 265 H.323 265, 266 peer-to-peer calls 268 RTP 266 See also VoIP pass through.
Index and policy routes 232 behavior 382 configured rate effect 383 examples 384 in application patrol 380 interface, outbound. See interfaces. interface’s bandwidth 385 maximize bandwidth usage 227, 232, 382, 383, 384, 395, 399 OSI level-7. See application patrol. over allotment of bandwidth 384 priority 384 priority effect 383 See also application patrol. 379 See also policy routes.
Index SSL 326 console port 55 speed 579 content (pattern) 439 content filtering 463, 464 and address groups 463, 464, 467 and address objects 463, 464, 467 and registration 466, 469 and schedules 463, 464, 467 and user groups 463 and users 463 by category 463, 468, 471 by keyword (in URL) 463, 480 by URL 463, 479 by web feature 463, 479 cache 468, 480 categories 471 configuration overview 120 default policy 464, 465 external web filtering service 468, 471 filter list 463 message for blocked access 465 poli
Index and interfaces 183 Domain Name System. See DNS. double-encoding 457 DTR 609 Dynamic Domain Name System. See DDNS. Dynamic Host Configuration Protocol. See DHCP. DynDNS 249 see also DDNS. E e-Donkey 427 EGP (Exterior Gateway Protocol) 451 EICAR 411 e-mail virus 403 e-Mule 427 Encapsulating Security Payload. See ESP.
Index and address objects 513 and schedules 513 prerequisites 123 fragmentation flag 437 fragmentation offset 437 FTP 605 additional signaling port 270 and address groups 606 and address objects 606 and certificates 605 and zones 605 signaling port 270 with Transport Layer Security (TLS) 605 full tunnel mode 61 full-tunnel mode 326 Fully-Qualified Domain Name (FQDN) 583 G gateway policy. See VPN gateways. Generic Routing Encapsulation. See GRE. global SSL setting 327 user portal logo 328 GRE 211 H H.
Index IDP 418 Snort signatures 443 statistics 643 traffic directions 418 updating signatures 173 verifying custom signatures 442 IDP (Intrusion, Detection and Prevention) 417 IDP and AppPatrol trial service activation 167 IDP profiles 421 IDP service group 428 IDP signature categories 427 IDP signatures and synchronization (device HA) 500 IEEE 802.1q. See VLAN.
Index IP static routes. See static routes. IP stream identifier 434 IP v4 packet headers 433 IPSec 291 basic troubleshooting 297 connections 296 Default_L2TP_VPN_Connection 346 Default_L2TP_VPN_Connection example 353 Default_L2TP_VPN_GW 346 Default_L2TP_VPN_GW example 351 established in two phases 291 L2TP VPN 345 local network 291 remote IPSec router 291 remote network 291 SA 292 SA monitor 320 See also VPN.
Index types of 625 log options 409 log options (IDP) 426 logged in users 163 login default settings 657 SSL user 332 logo 328 logout SSL user 335 logs and firewall 287 configuration overview 124 descriptions 663 e-mail profiles 627 e-mailing log messages 626, 631 formats 628 log consolidation 632 specifications 625 syslog servers 627 system 627 types of 627 loose source routing 434 M MAC addresses and VLAN 197 ZyWALL 158 macro virus 403 Management Information Base (MIB) 607 MD5 308 Message Digest 5.
Index and RIP 239 and static routes 239 and to-ZyWALL firewall 238 area 0 239 areas. See OSPF areas. authentication method 185 autonomous system (AS) 237 backbone 239 Configuration steps 240 direction 185 link cost 185 priority 185 redistribute 239 redistribute type (cost) 242 routers. See OSPF routers.
Index as VPN 211 product registration 757 profiles ADP 448 packet inspection 424 protocol usage statistics 400 protocol anomaly 448, 457 protocol anomaly detection 457 proxy servers 261 web. See web proxy servers. Public-Key Infrastructure (PKI) 546 public-private key pairs 545 Q query view (IDP) 426, 429 Quick Start Guide 65 R RADIUS 531, 536 advantages 536 and IKE SA 311 and PPPoE 211 and users 504 user attributes 505 real-time alert message 709 Real-time Transport Protocol. See RTP.
Index and authentication algorithms 236 and Ethernet interfaces 185 RTP 266 See also ALG. 266 S safety warnings 7 same IP 438 scanner types 404 schedules 527 and content filtering 463, 464, 467 and current date/time 527 and firewall 287, 394, 396, 398 and force user authentication policies 513 and policy routes 230, 392, 394, 396, 398 one-time 527 recurring 527 types of 527 where used 122 Secure Hash Algorithm. See SHA1. Secure Socket Layer. See SSL. security associations. See VPN.
Index SSH 600 and address groups 602 and address objects 602 and certificates 602 and zones 602 client requirements 601 encryption methods 601 for secure Telnet 602 how connection is established 600 versions 601 with Linux 603 with Microsoft Windows 602 SSL 326, 588 certificates 332 computer names 326 full-tunnel mode 326 global setting 327 IP pool 326 monitor 326 network list 326 policy 323 remote user login 332 remote user logout 335 user screen bookmarks 335 user screens 331, 334 user screens access met
Index T T/TCP 458 task bar properties 710 TCP 521 ACK (acknowledgment) 453 ACK number 438 connections 521 port numbers 521 SYN (synchronize) 453 window size 438 TCP Decoder 457 TCP decoy portscan 451 TCP distributed portscan 451 TCP flag bits 438 TCP portscan 451 TCP portsweep 451 TCP RST 452 TCP SYN flood 453 TCPdump 440 Telnet 604 and address groups 604 and address objects 604 and zones 604 with SSH 602 terminate user connection 327 terminology differences bandwidth management 112 NAT 112 with other prod
Index and content filtering 463 and firewall 287 and policy routes 230, 392, 394, 396, 398 configuration overview 122 user names rules 508 user portal See SSL user screens. 331, 334 user portal links 567 user portal logo 328 user sessions. See sessions. user SSL screens 331, 334 access methods 331 bookmarks 335 certificates 332 login 332 logout 335 required information 332 system requirements 331 users 503 access. See also access users. Admin (type) 503 admin. See also admin users.
Index advantages 318 and IPSec SA policy enforcement 320 disadvantages 318 VPN connections and address objects 296 and policy routes 230, 231, 296 VPN gateways and certificates 296 and extended authentication 296 and interfaces 296 and to-ZyWALL firewall 297 VPN. See also IKE SA, IPSec SA.
